Declassified and app^ri^ frf on 1 1-08-2013 

pursuant to E.Q. 13526 









«s^ cu Ccy^a-<^ 



REF ID:A66790 




, 3 





RESTIUCTEB 



SECTION IX 

POLYGRAPHIC SUBSTITUTION ’SYSTEMS 



Paragraph 

General remarks on polygraphic substitution 6k 

Polygraphic substitution .methods employing large tables. ».»••• ••»•*• 6^ 

Polygraphic substitution methods employing small matrices 66 

Methods for recognizing polygraphic substitution ' 6j 

General procedtire In the Identification and analysis of polygraphia 

substitution ciphers 68 

Analysis of four-square matrix systems. .............. 69 

Analysis of tvo-square matrix systems...... 70 

Analysis of Playfair cipher systems.............. 71 

Analysis of polygraphic systems Involving large tables..... 72 

Further remarks on polygraphic substitution systems... 73 



64. General remarks on polygraphic substitution . — a. The substi- 
tution systems dealt with thus far have Involved plaintext units con- 
sisting of single elements (usually single letters). The major dis- 
tinction between them has been made simply on the basis of the nuniber of 
elements constituting the ciphertext milts of each; l.e., those In- 
volving single -element ciphertext units were termed unlllteral , and those 
Involving clpheirtext units composed of two or more elements were termed 
multlllteral That Is to say, when the tepns "unlllteral” , "billteral", 
‘^trlllterail'* , etc., were used. It was to have been automatically inferred 
that the plaintext xxnlts were composed of single elements. 



b. This section of the text will deal with substitution systems 
Involving plaintext units composed of more than one element; such 
systems are termed polygraphlc (By comparing this new term with the 
terms "unlllteral" euid "imiltillteral" It miay then be deduced — and cor- 
rectly so — -Uiat a term Involving the stiff lx "-literal" Is descriptive of 
the composition of the cipher text units of a cryptosystem, and that a 
term containing the suffix "-graphic" describes the composition of the 



^ See also subpar. 52a. 

2 * 

Systems involving plaintext units composed of single elements may, 
on this basis, be termed monographic; however, as has been stated In 
connection with the terms "unlllteral" and "multlllteral", the plaintext 
units of a system are understood (without restatement) to be monographic 
unless otherwise specified. 
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plaintext units .^) Polygraphic systems in vhieh the plaintext units are 
coraposed of two elements are called dlgraphic , those! in which the plain- 
text xmlts are composed of three elements are trlgreiphic, etc* 5Ihe 
ciphertext units of polygraphie systems usually conS|lat 'of the same 
nu^er of elements as the plaintext units Thus, if a system is called 
’’digraphlc", it may he assumed that the ciphertext units of the system 
consist of two elements, as do the plaintext units; jlf this were not the 
ease, the term ”di^aphic” hy itself wo^lld not he adequate to describe 
the system corlpletely, and an additional modlfylx)g f^rd or phrase would 
have to he used to indicate this fact. 5 i 

c. In polygraphlc substitution, the ccmiblnatlolis of elements which 
constitute the plaintext units ere considered as indjivislhle cospoxmds • 
The units are composite In character and the individual elements coxopos-* 
ing the units affect the equivalent cipher units jointly , rather than 
separately. The basic isportant factor in true polygraphlc substitution 
is that all the letters of each plaintext unit partljsipate in the de- 
termination of its cipher equivalent; the Identity of each element of 
the plaintext unit affects the composition of the wfahle cipher unlt.° 
Thus, in a certain dlgraphic system, ABp may ^ encij^ered as XP^; end 
PC-p, on the other hand, may he enciphered as NK^; a difference in the 
identity of hut one of the letters of the plaintext ^Ir here produces a 
difference in the identity of both letters of the cipher pair.' 

" ' 'a ' " ^ I 

• In this connection, it is further pointed out that since the root 
"literal" derives from the Latin "lltex'a", it is conventionally prefixed 
by modifiers of Latin origin, such as "uni-", "hi-", [and "multi-"; slml- 
"graphic", deriving from the Greek "graphikosj', is prefixed hy 
modifiers of Greek origin, such as "mono-", "dl-", and "poly-". 

“ ^ The qualifying adverb "usually" is employed because this corre- 
spondence Is hot essential. For example, if one should draw up a set of 
676 arbitrary single signs, it would be possible to Represent the 2- 
letter pairs from AA to ZZ by single symbols. This would still be a di- 
graphlc system. 

^ See subpars. ^5^ and 66f for exanples of two such systems and their 
names . 

I 

° An analogy Is found in chemistry, when two elements combine to form 
a molecule, the latter usually having properties quite different from 
those of either of the constituent elements. For example: sodium, a 

metal, and chlorine, a gas, combine to form sodium cliilorlde, common 
table salt. However, sodium and fluorine, also a gas similar in many 
respects to chlorine, combine to form sodium fluoride, which is much 
different from table salt. 

For this reason the two letters ere mexked by a | ligature; that is, 
by a bar across their tops . In cryptologic notation] the synibol 68p 
means "any plaJ.nt.ext digraph"; the symbol 60c ^ "aiiy ciphertext digraph". 
To refer specifically to the 1st, 2d, 3d,,,, m ember of a ligature, the 
ex ponen t 1, 2, 3,*»* will be used. Thus 0p of EE^^ is the letter E; 6| 
of XRZg is Z, See also footnote 1 on page -H, I 
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d. The fundamental purpose of pol^rgraphlc substitution Is again 

the sv^presslon or the elimination of the frequency characteristics of 
single letters of plain text, Just as is the case in monoalphabetic 
substitution vlth variants ; hut here this la accomplished hy a different 
method, the latter arising from a somewhat different approach to the 
problem Involved in producing cryptographic securlty« When the suibstl- 
tutlon Involves replacement of single letters in a monoalphabetic system, 
even a single cryptogram can be solved rather readily; basically the 
reason for this is that the principles of frequency and the laws of 
probability, applied to individual units (single letters) of the plain 
text, have a very good oi^port^nity to manifest themselves. However, 
when the substitution involves replacement of plaintext units composed of 
two or ipre letters— rthat is, when the substitution is polygraphlc in 
nature --the principles of frequency and laws of probability have a much 
lesser opportunity to manifest themselves. If the substitution is dl- 
graphlc, then the units are pairs of letters and the normal frequencies 
of plaintext digraphs become of first corisiileratlon; if the substitution 
is trlgraphic, the units are sets of letters and the normal fre- 

quencies of irlalflt@xt trl^aphs are Involved. In these cases the data 
that c^49is"* employed in the solution ere meager ; that is why, lE^nerally 
f^ief^tiig, the Solution of polygraphlc substitution ciphers is dfben ex- 
tremely difficult. 

e. By way of example, a given plaintext message of say n letters, 
eticlphered by means of a unilltereJ. substitution system, affords n 
cipher characters, and the same number of cipher units. The saamTmess'age, 
enciphered dlgraphlcally, still affbrds n cipher characters but only-^ 

cipher units. Statistically speaking^'the sample to which the laws of 
probeblllty now are to be applied hahtbeen cut in half. Furthermore, 
from the point of view of frequency;, jthe very noticeable diversity in 
the frequencies of individual lette^^ ^ leading to the marked crests and 
troughs of the unlllteral frequency ‘distribution, is no longer so 
strikingly in evidence in the frequencies of digraphs. Therefore, al- 
though dlgraphle encipherment, for example, simply cuts the cryptographic 
textual, units in half, the number of elpher units which must be identi- 
fied has been squared ; and the dl:^icUlty of solution is not merely 
doubled but, if a matter of Judgment arising from practical experience 
can be expressed or approximated mathematically, squared or ctbed. 

f . The following two paragraphs will treat various polygraphlc 
substitution methods. The most practical of these methods are dlgraphle 
In chtf aet^ and for this reason their treatment herein will be more de- 
tailed than thdt of trlgraphic methods. 

65 . Polygraphlc substitution methods employing large tables .— 

a. The simplest method of effectix^ polygraj^lc substitution in- 
volves the use of tables similar to that shown in Figure k^a. This 
table merely provides equivalents for digraphs, by means of the coordi- 
nate system. Specifically, in obtcdulng the cipher equivalent of any 



RESTRICTED 



153 



nESTRlCTED 



REF ID : A66790i 





A 


B 


C 


D 


G 


F 


G 


H 


I 


J 


K 


L 


M 


N 


6 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


A 


WG 


EE 


SN 


TR 


lA 


NL 


GC 


HT 


01 


UO 


AM 


RP 


BY 


KB 


CD 


DF 


FH 


JJ 


LK 


HQ 


PS 


QU 


w 


xw 


YX 


ZZ 


B 


EG 


SG 


TN 


IR 


NA 


GL 


HC 


OT 


UI 


AO 


R!tl 


BP 


KY 


CB 


DD 


FF 


JH 


U 


MK 


PQ 


QS 


VU 


XV 


YW 


ZX 


wz 


C 


SG 


TE 


IN 


NR 


GA 


HL 


OC 


UT 


AI 


RO 


EM 


KP 


CY 


DB 


FD 


JF 


LH 


MJ 


PK 


QO 


-VS 


?u 


T\f 


Zff 


wx 


EZ 


D 


TG 


IE 




GR 


HA 


OL 


UC 


AT 


RI 


BO 


KM 


CP 


DY 


FB 


JD 


LF 


MH 


PJ 


OK 


VQ 


XS 


YU 


ZV 


ww 


EX 


sz 


E 


IG 


NG 


GN 


HR 


OA 


UL 


AC 


RT 


BI 


KO 


CM 


DP 


FY 


JB 


LD 


MF 


PH 


QJ 


VK 


XQ 


YS 


ZU 


WV 


EW 


SX 


TZ 


F 


NG 


GE 


HN 


OR 


UA 


AL 


RC 


BT 


KI 


CO 


DM 


FP 


JY 


LB 


MD 


PF 


OH 


VJ 


XK 


YQ 


zs 


WU 


EV 


SW 


TX 


IZ 


G 


GG 


HE 


ON 


UR 


AA 


RL 


BC 


KT 


Cl 


DO 


FM 


JP 


LY 


MB 


PD 


QF 


VH 


XJ 


YK 


ZQ 


ws 


EU 


SV 


TW 


IX 


NZ 


H 


HG 


OE 


UN 


AR 


RA 


BL 


KC 


CT 


DI 


FO 


JM 


LP 


MY 


PB 


QD 


VF 


XH 


YJ 


ZK 


WQ 


ES 


SD 


TV 


IW 


NX 


GZ 


I 


OG 


UE 


AN 


RR 


BA 


KL 


CC 


DT 


FI 


JO 


LM 


MP 


•py 


QB 


VD 


XF 


YH 


ZJ 


TO 


EQ 


SS 


TU 


IV 


NW 


GX 


HZ 


t 

u 


UG 


AE 


RN 


BR 


KA 


CL 


DC 


FT 


JI 


LO 


MM 


PP 


QY 


VB 


XD 


YF 


ZH 


WJ 


EK 


'so 


TS 


lU 


NV 


GW 


HX 


OZ 


X 


AG 


RE 


BN 


KR 


CA 


DL 


FC 


JT 


LI 


MO 


FM 


QP 


VY 


XB 


YP 


ZF 


TO 


EJ 


SK 


TO 


IS 


NU 


CV 


HW 


OX 


uz 


L 


RG 


BE 


KN 


CR 


DA 


FL 


JC 


LT 


MI 


PO 


QM 


VP 


XY 


YB 


ZD 


WF 


EH 


SJ 


TK 


ilQ 


NS 


GU 


HV 


OW 


UX 


AZ 


U' 


BG 


KE 


CN 


DR 


FA 


JL 


LC 


MT 


PI 


QO 


VM 


XP 


YY 


ZB 


WD 


EF 


SH 


TJ 


IK 


NQ 


GS 


HU 


OV 


UW 


AX 


RZ 


H 


KG 


CE 


DN 


FR 


JA 


LL 


MC 


PT 


QI 


VO 


XM 


yp 


ZY 


m 


ED 


SF 


TH 


IJ 


NK 


po 


HS 


OU 


UV 


AW 


RX 


6Z 


0 


CG 


DE 


FN 


JR 


LA 


ML 


PC 


QT 


VI 


XO 


YM 


ZP 


WY 


EB 


SD 


TF 


IH 


NJ 


GK 


HQ 


OS 


UU 


AV 


RW 


BX 


KZ 


P' 


DG 


FE 


JN 


LR 


MA 


PL 


QC 


VT 


XI 


YO 


ZM 


WP 


EY 


SB 


TD 


IF 


NK 


GJ 


HK 


PQ 


US 


AU 


RV 


BW 


KX 


CZ 


Q 


FG 


JB 


LN 


MR 


PA 


QL 


VC 


XT 


YI 


ZO 


m 


EP 


SY 


TB 


ID 


NF 


GH 


HJ 


OK 


UQ 


AS 


RU 


BV 


KW 


CX 


DZ 


R 


JG 


LE 


MN 


PR 


QA 


VL 


xc 


YT 


ZI 


wo 


EM 


SP 


TY 


IB 


ND 


GF 


HH 


OJ 


UK 


4q 


RS 


BU 


KV 


CW 


DX 


FZ 


s’ 


LG 


ME 


PN 


QR 


VA 


XL 


YC 


ZT 


WI 


EO 


SM 


TP 


lY 


NB 


GD 


HF 


OH 


UJ 


AK 


RQ 


BS 


KU 


CV 


DW 


FX 


JZ 


T 


MG 


PE 


QN 


VR 


XA 


YL 


ZC 


WT 


El 


SO 


TM 


IP 


NY 


GB 


HD 


OF 


UH 


AJ 


RK 


BQ 


KS 


CU 


DV 


FW 


JX 


LZ 


U 


PG 


QE 


VN 


XR 


YA 


ZL 


WC 


ET 


SI 


TO 


IM 


NP 


GY 


HB 


OD 


UF. 


AH 


RJ 


BK 


KQ 


cs 


DU 


FV 


JW 


LX 


MZ 


V 


QG 


VE 


XN 


YR 


ZA 


WL 


EC 


ST 


TI 


10 


NM 


GP 


HY 


OB 


UD 


AF 


RH 


BJ 


KK 


CQ 


DS 


FU 


JV 


LW 


MX 


PZ 


W 


VG 


XE 


YN 


ZR 


m 


EL 


SC 


TT 


II 


NO 


GM 


HP 


OY 


UB 


AD 


RF 


BH 


KJ 


CK 


DQ 


FS 


JU 


LV 


MW 


PX 


QZ 


X 


XG 


YE 


ZN 


vm 


EA 


SL 


TC 


IT 


NI 


GO 


HM 


OP 


UY 


AB 


RD 


BF 


KH 


CJ 


DK 


FQ 


J3 


LU 


MV 


PW 


QX 


VZ 


Y 


YG 


ZE 


TO 


ER 


SA 


TL 


IC 


NT 


Cl 


HO 


OM 


UP 


AY 


RB 


BD 


KF 


CH 


DJ 


FK 


JQ 


LS 


MU 


PV 


QW 


VX 


xz 


Z 


ZG 


m 


EN 


SR 


TA 


IL 


NC 


GT 


HI 


00 


UM 


AP 


RY 


BB 


KD 


CF 


DH 


FJ 


JK 


LQ 


MS 


PU 


QV 


VW 


XX 


YZ 



I 



Figure 47a. i 

j ^ 

plaintext digrapli, the Initial letter of the plaintext digraph' is vised 
to Indicate the vov in vhlch the equivalent is found ^ and the final 
letter of the plaintext digraph indicates the column; the cipher digraph 
is then foxmd at the interaction of the row end column thus indicated. 
For exanqole, KGp:^^; Wl^rOYg; etc. j 

h. In the preceding table two mixed sequences wre en^iloyed to 
form the cipher equivalents, one sequence being based on the key phrase 
IffiSTHJGHOUBE AIR BRAKE and the other on GENERAL ELECTRIC COMPANY. The 
table in Figure hja could have been drawn up in a slightly different 
manner, as shown in Figure 47b, and still yield the same cipher equiva- 
lents as before. Using this Tatter tabis> 0^ for any plaintext digraph 

is fovind at the intersection of the row and column identified by 6^ and 

0p, respectively; is foxmd in the sequence below the table and is 
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Figure ^Tb, 



taken from the position directly under the column identified by 0' 



few sample encipherments will illustrate that this table is cryptographi- 
cally equivalent to that of Fig, 47a* 

£, Figures 48 and 49, below, contain other possible types of tables 
for digraphic substitution. In Fig. 48, it will be seen that there are 
two vertical sequences to the left of this table and no horizontal 
sequence below it. 0^ is located in the leftmost sequence, 0^ being 

found directly to its side in the right-hand sequence; 0^ is then found 

1 p 

at the intersection of the row and column identified by 0p and ©p. 
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ABCDEFGHIJKLMNOPQRSTUVBXYZ 



G E N R A 
E N R A L 
K R A L C 
R A L C T 
A L C T I 
L C T I 0 
C T I 0 M 
T I 0 M P 
I 0 M P Y 
0 M P Y B 
M P Y B D 
P Y B D F 

Y B D F H 
B D F H J 
D F H J K 
F K J K Q 
H J K Q S 
J K Q S U 
K Q S U V 
Q S U V W 
S U V W X 
U V W X Z 

V W X Z G 
W X Z 6 E 
X Z G E N 
Z G E N R 



L C T I 
C T i 0 
T 1 0 M 
I 0 M P 
0 M P Y 
M P Y B 
P Y B D 

Y B D F 
B D F H 
n F H J 
F H J K 
H J K Q 
J K Q S 
K Q S U 
Q S U V 
S U V V? 
U V W X 

V W X Z 
W X Z G 
X Z G E 
Z G E N 
G E N R 
E N R A 
N R A L 
R A L C 
A L C T 



0 M P 
M P Y 
P Y B 

Y B D 
B D F 
D F H 
F H J 
H J K 
J K Q 
K Q S 
Q S U 
SUV 
U V W 

V W X 
W X Z 
X Z G 
Z G B 
GEN 
B N R 
N R A 
R A L 
A L C 
LOT 
C T I 
T I 0 

1 0 M 



Y B D 
B D F 
D F H 
F H J 
H J K 
J K Q- 
K Q S 
Q S U 
SUV 
U V W 

V X 
W X z 
X Z G 
Z G E 
GEN 
E N R 
N R A 
R A L 
A L C 
LOT 
C T 1 
T I 0 
I 0 M 
Q M P 
M P Y 
P Y B 



F H J 
H J K 
J K (i 
K Q S 
Q S U 
SUV 
U V .W 

V W X 
W X Z. 
X Z G 
Z G E 
GEN 
E N R 
N R A 
R A L 
A L C 
L C T 
C T I 
T I 0 
I 0 M 
0 M P 
M F Y 
P Y B 

Y B D 
B D F 
D F H 



K Q s y 
Q S U jV 
S U V W 
U V W X 

V w X k 
W X Z (3 
X.Z G E 
Z 6 E N 
G E N R 
E N R 

N R A L 
R A L p 
A L C T 
L C T k 
C T I 6 
T I 0 M 
I 0 M k 
0 M P Y 
M P Y B 
P Y B b 

Y B D F 
B D F H 
D F H jj 
F H J K 
H J K Q 
J K Q S 



V N X Z 
W X Z G 
X Z G E 
Z G E N 
G E N R 
E N R A 
N R A L 
R A L C 
A L C T' 
LOTI 
C T I 0 
T I 0 M 
i 0 M P 
0 M P Y 
M P Y B 
P y B D 
y B d’f 
B D F H 
D F H J 
F H J K 
H J K Q 
J K Q S 
K Q S U 
Q S U V 
S U V W 
U V W X 



Figure’ 4S. i 

respectively. The table in Fig. 49 provides digrapliic equivalents by 
means of the coordinate system (e.g,’, REpSjZj.), in the same manner, as in 
Fig, Uja, and a cursory examination of the inside o:^ the table might 
disclose nothing new' about this table at all. But, iif orie wre to scan 
closely the diagonals fonned by each 0^ from upper right to lower left, 

he vrould see that each such dlagonaj^ changes below the ”1^ row"; simi- 
larly, if the diagonals formed by 6g are scanned frc|m upper left to 

lower right, it will be seen that each of them also | changes after the 
row”. In effect, the Inside of the table is dlyided into two sepa- 
rate portions by an iBiaglnary line extending horizontally between the 
H and K rows ; but within each portion a straightforward type of symmetry 
is exhibited and the same two mixed sequences have been employed in each. 
Actually, in a 26x26 table, it is not possible to maintain the diagonals 
formed thus by 6c and 0^ in a completely "vmbroken” j sequence without 

I 

producing repeated digraphs within the table and wllihout consequent 
cryptographic ambiguity; thus, Pig, 49 illustrates one type of limited 
diagonal symmetry which must be resorted to in the systematic con- 
struction of such a table, ; 
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Figixre 49. 



d. All of the foregoing tables have e3diibited a symmetry In the 
arrangement of their contents ^ vhich is undesirable from the standpoint 
of cryptographic security. This systematic Internal arrangement could 
be detected by a cryptanalyst early in his attack on cryptograms pro- 
duced through their use, permitting rapid reconstruction of the particular 
table involved; this subject will be given a more detailed treatment in 
par. 72. The table in Figure 50 is an example of one type of table vhich 
vould provide more security than the foregoing. This table is con- 
structed by random assignment of values and shows no symmetry whatsoever 
in its aireuigement of contents . It will be noted that this table is 




RE S TRICTED 



REF ID : A66790 



(Showing only a partially filled table} ' 
Final Letter (d®p) 
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FX 


CH 


XE 


YY 
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FH 
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NB 
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XX 


DX 
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AB 
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ND 
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AY 










BF 
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AX 










AI 
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AG 






NZ 






AZ 














AA 




























; 












— 
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BC 




CY 
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BAFE 
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• 
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X 










AC 










AJ 




• 
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BE 
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DE 












AF 
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• 
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AD 
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AE 
















BD 
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» 
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AK 








A 


B C 
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J K 
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Y Z 
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B 
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y. 

z 



Figure 50* 



reciprocal In nature j that la AFpSys^ and YOpSAF^. rThus, thla single 
table serves for deciphering as veil as for enciphering. Reciprocity 
Is, however, not an essentleQ. factor; In fact, greater security Is pro- 
vided by non-reciprocal tables. Biit,.ln the case of such non-reciprocal 
randomly constructed tables, each enciphering tablej must have Its cookie 
mentary deciphering table. 1 



e. Dlgraphlc tables en^loylng nuxoerlcal equlvjalents Instead of 
letter equivalents may be encountered. However, since 676 equivalents 
are required (there being 6 t 6> or 26x26, different pairs of letters), 
this means that combinations of three figures must ibe used; such systems 
are termed trlnome -dlgraphlc • systems , indicating clearly the number of 
elements \dilch comprise the -.cipher units. By way o|f an exas^le, the 
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fbailowlng figure contain a fragment of a table® which provides trlnome 
equivalents for the plaintext digraphs: , 




A- . B- G D E 
.001 002 003 004 005-..^ ... 
027 028 029 030 031- 
053 054: , ‘ 



• • • 



025 026 
051 052 



• •• ,-r 



Y 
. Z 



I .< • • 

625 626 
651 652 




649 650 
675 676 



Figure 51. ; 



f . All of the foregoing tables have -been dl^ap&Lc in nature ^ but 
a kind of false trlgraphic stfbstltublon may also be accomplished by means 
of similar tables, as Illustrated in Figure 52, wherein the table Is the 
same as that In Figure 49 with the addition of one more sequence at the 
top of the table* In using this table, 0^ Is located In sequence I, and 

B • „ 

It Is Interesting to note that this conparatlvely bulky and unwieldy 
table can be reduced to the following two alphabets with numerical 
equivalents for the letters: 

(1) A‘ -B- C i) E F . . ... X Y Z 

000 026 052 078 104 130 598 624 650 



(2 )ABCDEF XYZ 

.'-•ri 2-/3 456. . . . . 24 25 26 • 

In enciphering, the first letter of the plaintext dlgrEgph Is converted 
Into' Its numerical value from alphabet 'tl') , and the second plaintext 
letter Is,, converted by means of alphabet (2); the two numerical v^ues 
thus derived are added together, and their sum Is taken as the cipher 
equivalent of the partlcxilar plaintext digraph. Of course, this simple 
reduction would not be possible If the trlnomes. In ascending order, had 
been arranged :ln the table In, say, a diagonal manner. 
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III. 
IV. 
I. II. 
A W 
B E 
C S 



H H 
I 0 
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N K 
0 C 
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Figure 52. 

X 2 i ' ' 

its equivalent, 6^, talsen from sequence II; 6^ l£| located, in sequence 

III, and its equivalent, 9® taken from sequence |lV; 9^ is the letter 

® I Q ® 

lying at the intersection of the raw indicated hy 9^ In sequence I and 

the column determined hy 9p. Thus, FIRE LINES votild he enciphered NNZ 

lEQ K07 . Various other agreements may he made with respect to the 
alphabets In which each plaintext letter will he! sought In such a table, 
hut the basic cryptographic principles are the sqaie as In the case 
described. i 

I , 

g. Tables s\ich as those Illustrated In Figs. 47-52, above, have 
been encountered In operational systems, but their use has xu>t been vej^ 
widespread because of their relatively large size and the Inconvenience 
In their production and handling. In lieu of these large tables It is 
possible to enq>loy much smaller matrices or geometrical designs to ec- 
coinpllsh dlgraphlc substitution; methods Involving their tise will be 
discussed In the following paragraph. | 
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66. Polycraphlc suTjstltutlon methoda employing small ma.tr3.ces .^ — 
a, A simple method for accomplishing digraphic substitution in- 
volves the use of the four-square imtrlx , a matrix consisting of four 
5x5 squares in vhich the letters of a 25-element alphabet (combining I 
and J) are inserted in any prearranged order. When four such sq-uares 
are arranged in a matrix as shovn in Figure 53 , the latter may be em- 
ployed for dlgraphic substitution to yield the same cipher results as 
does a much larger table of the type treated in the preceding paragraph. 

In a four-square matrix, of is sought in section 1; 0^, in section 

1 2 ■ P 

2. Thvis, 0p and 0p vlll always form the northwest -southeast corhers of 

an imaginary rectangle delimited by these two letters as located in 

1 2 

these two sections of the square. Then 0^ and 0^, are, respectively, the 
letters at the northeast-southwest comers of this sa^ rectangle. Thus, 
TGp^XSc? ^p^^pJ decrypting, and 0^ ore 

soTight in sections. 3 and U, respectively, and their equivalents, 0^ and 
0p, noted in sections 1 and 2, respectively. 
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Sec. 3 (ej) 



Sec. 2 (0 ) 
P 



Figtire 53* 

b. It is possible to effect digraphic substitution with a matrix 
consisting of but two sections by a modification in the method of find- 
ing equivalents. In a horizontal two-square matrix , such as that shown 

in Figure 5^^ ®p of ^p is located in the square at the left; 0p, in the 

square at the right. 



g 

The word matrix as employed in this paragraph refers to checker- 
board-type diagi*ams smaller than the tables illustrated in the preceding 
paragraph. These matrices are usually cong>osed of sections containing 
25 cells each. 
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Figure 5^. i 

12 ' i 

When 6p and 6p are at the opposite ends of the djiagonal of an imaginary 

rectangle defined "by these letters, the ciphertejxt equivalent comprises 
the two letters appearing at the opposite ends cif the other diagonal of 

the same rectangle; 0^ is the particular one which is in the seme row as 

12 O' 

6p, and 9 q is the one in the same row ns 6^. For exaitiple, MjpiiiTTc; 

DOp=GA^j. When 0p and 0p happen to he in the saipe row, the ciphertext 

equivalent is merely the reverse of the plaintext digraph; for example, 
and EHp=HEc , j 

c, Dlgraphic suhstitution may also he effected by means of vertical 
two -square matrices , in which one section is directly above the other; as 
in Figure 55 i it will be noted that matrices ofi this type have a feature 
of reciprocity when employed according to the usual rules, which follow. 
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Figure 55.’ 
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When 6p and 9p are at the oxrposlte ends of a diagonal, the rule for en- 
cipherment la the Bane as that for horizontal two-sguare encipherment 
(e.g., and vhen hoth Op and 6p happen to he in the same 

column, the plaintext digraphs axe self -enciphered, (e.g., MApdSi^ end 
a fact iihlch constitutes an Important ^teekness of this method 
This disadvantage Is only slightly less ohvlous In the preceding case of 

horizontal two-sguare methods ^diereln the cipher equlvalekt of con- 
sists merely of the plaintext letters In reversed order. 

d. One -square dlgraphle methods, vlth a necessary modification of 

the method for finding equivalents, ere also possible. The first of 

this tjfpe to appear .as a practical military system was that known as the 

11 ‘ • - 
Playfair cipher . It vas used for a nunfber of years as a field cipher 

hy the British Aniy, before and during World War I, and for a short time, 

also during that var, hy certain units of the American Expeditionary 

Forces. Figure 56 shows a typical Flayfolr sguaz^. The modification In 

the method of fli^l^ cipher equivalents has heen found useful In 
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Figure 56 , 



iJEpartlng a greater degree of security than that afforded In the preced- 
ing small matrix methods . The usunl method of encipherment can he best 
explained hy examples given trader four categories; 



See stihpar. 73fb on other enciphering conventions which remove this 
weakness . " . 

^ This cipher was really Invented hy Sir Charles Wheatstone hut re- 
ceives Its name from Lord Playfair, who apparently was Its sponsor before 
the British Foreign Office. See Wemyss Reid, Memoirs of Lyon Playfair , 
London, 1&99* It Is of Interest to note that, to students of electrical 
engineering, Wheatstone is generally not known for his contributions to 
cryptography hut Is famed for something he did not Invent— the so-called 
Wheatstone bridge", really Invented by Samuel H.. Christie. 
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(l) Members of the plaintext pair, 6^ and 

Jr 



IP" 



are at opposite ends 



of the diagonal' of an imaginary rectangle defined hy the two letters ; 
the members of the ciphertext pair, 0^ and 0^, are at the opposite ends 
of the other diagonal of this imaginary rectangle . Examples: 

Mp=uCgi nfp=^j vip=TCc. 

(2) 0^ and are in the same rowj tlie letter immediately to the 
right of 0p forms 0 qJ the letter immediately to the right .of Q'z forms 

P 12 'I " 

©Q. When either 0* or 0p is at the extreme right of the row, the first 
letter in the row becomes its cipher equivalent. Examples: 

Mip=SFcJ M'p=^J FApriSr^. . 

(3) 6p and ©| are in the same column; the letter immediately below 
©p forins 0Q, the letter immediately below 0p forms ©|. vrhen either ©p 
or ©p is at the bottom of the column, the top letter in that column be- 



MCp^B(j,| 



AWpSTAc; WApZATc; 



comes its cipher equivalent. Examples: 

®P=^- ,2 

W ej and ©p are identical; they are to b^ separated by insexi^lng 
a null, usually the letter X or Q, and subsequenl^ly enciphered by the 
pertinent rule from above. For example, the word BATTEES would be en- 
ciphered thus: 

BA TX TL ES 
IM RW CO KP 

. • 

The Playfair square is automatically reciprocal so far as encipherments 
of type (l) above are concerned; but this 'is not true of encipherments 
of type (2) and (3). 

e. It fs not essential that the small matrices used for dlgraphic 
substitution be in the shape of perfect squares; rectangular designs will 

32 

serve equally well, with little or no modification in procedure. For 
example, each section of, say, a four-square matijlx could be constructed 
with four rows containing six letters each by ha>^ing Up serve for Vp, as 

well as Ip for Jp, Furthermore, it is possible llo expand the sections of 

by the follo'iring subter- 
the cipher text .^3 One 



a digraphic matrix to 28, 30, or more characters 
fuge, without introducing digits or symbols into 



^ However, because the terms "four -squ^e matrix”, ''tvro -square matrix", 
and "Playfair sqviare ” have become firmly fixed ir cryptologic literature 
and practice, they continue to be, applied to all such matrices, even 
when the "squares" of such matrices do not contain an equal number of 
rows and columns (that is, even when they are not square). 

^3 The addition of any symbols such as the digits 1, 2, 3,i,. • into a 
matrix solely to augment the number of elements to, 27, 28, 30, 32, or 3^ 
characters would not be considered practicable, since such a procedure 
would result in producing cryptograms, containing lintermixtures of letters 
and figures, 
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of the letters of the alphabet may he omitted from the set of 26 letters, 
and this letter may then he replaced hy 2, 3> or more pairs of letters, 
each pair having as one of its memhers the omitted single letter. The 
5x6 Playfair square of Figure 57a has been derived thus; the letter K has 
been omitted as a single letter, "and the number of characters in the 
rectangle has been made a total of 30 by the addition of five combi- 
nations of K with other letters , An interesting consequence of this 
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Figure 57a. 



modification is that certain irregularities are introdTiced in any crypto- 
gram produced throvi^ its \ise; for example, (l) occasionally a plaintext 
digraph is replaced by ciphertext trlgraph or tetragraph, such as 



DKE, 



■‘Of 

as the 



c' 



AMp ^aKUq and EPpSKESKOg; and (2) variant values may appear— BKE., 

KEPq, CTq, and TPq all may be used to represent 01^, As far 

deciphering is concerned, there is no difficulty because any K occurring 
in the cipher text is considered as invariably fonning a ligature with 
the succeeding letter, taking the pair of letters as a unit; and, when a 
plaintext vmit is obtained cont%ining on e of the K-pairs, the letter 
after the K is disregarded; for example, CKO^ is reed as CK. The four- 

siquare matrix has ‘aiso'been cohstimcted using the foregoing 
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subterfuge . With this latter matrix, numbers la. the plain text may be 
enciphered, still without producing cipher text containing numbers; for 
example, the plain text "HILL 3^06" would be represented by the cipher 



QAB AT KUKI NQE, which would be regrouped into groups of five letters 
and sent as QABAT KUKIN I 



f . FiESure 58 shows a nvmierical four-square matrix which presents a 
rather interesting feature in that it makes possible the substitution of 
3-figvire combinations for digraphs in a unique manner. To encipher a 
message one proceeds as usual to find the numerical equivalents of a pair, 
and then these numbers are added together. Thus: 
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Sec. 2 



Figure 58 • 



In deciphering, the greatest- multiple of 25 contained in the group of 
three digits is determined; then this multiple and its remainder are used 
to form the elements for determining the plaintext pair in the usual 
manner. Thus, 284=275 t 9=PR, | ■ 

I 

£, Thus far all the small-matrix methods hai/fe involved only di- 
graphic substitution. The tvro matrices together illustrated in Figures 
59a and b may be used to provide a system for encipherment which is 
partly trigraphic; the adverb ’’partly” has been usjed because this par- 
ticular system will yield trlgraphic encipherment japproximately 88.5^ of 
the time in ordinary text and digraphic encipherment approximately 11,5^ 
of the time,^^ In this case the cipher equivalents of the trigraphs 



These figures are based on the number of trigiraphs ending in one of 
the 15 highest -frequency letters (ETHROAISDLHCFPUy, and on the number of 
trigraphs ending with other letters. 
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Gi G2 63 
K3 ,K4 Ml 
Rl R2 R3 
W3 W4 Xi 
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Figure 59 a • 



(or digraphs, as the case nay he) are tetranones. Encipherment is hest 
Illustrated hy an exaa^jlej this is given in the next subparagraph. 

h. Let the text to be enciphered be a message beginning with the 
vords~"REIERRIHG TO YOUR MESSAGE HOMBER FIVE STOP ...” This is re^rritten 
into trigraphs, with the proviso that the third letter of the trigraph be 
one of the letters contained in the small square in Fig. 5S^J lY the 
third letter is not one of these 15 letters, the plaintext grouping is 
left, as a digraph; then the ©rouping into trigraphs (or digraphs) con- 
tinues. Thus, the foregoing plain text would be written as follows: 

REF ERR IN- GTO YOU RME SSA GEN UM- BER FI- VES TOP . . . 

In encipherment, it is to be noticed that Rp occurs four times in section 
1 (as do all the letters) and Ep occurs four times in section 2; the 
proper combination of the 16 possibilities is determined by the coordi - 
nates of the third letter of the trlgraph as indicated in the small 
square. Fig. 59b. Since the coordinates of Fp in this square are 42, 
then it is the ¥th occxirrence of Rp in section 1 and the ^ occurrence 

of Ep in section 2 which are used to obtain the equivalent for the tri- 
graph this equivalent is 1905. When the plaintext unit as obtain- 

ed above is only a digraph, it is the 1st occurrence of 6^ which is xised 
in section 1 and the 1st occurrence of Op which is vised in section 2; 

thus, "IN-” from the saxnple message beginning, above, would be enciphered 
2828. The encipherment of the plaintext example above is then 

REF ERR IN- GTO YOU RME SSA GEN UM- BER FI- VES TOP 

1905 408l 2828 4719 0727 1372 7417 4ii8 2270 3807 4024 8806 8623 
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The cipher text could then he .transmitted in groups of four digits, or, 
as a subterfuge to conceal the basic group lengt]^, the transmission ' 
could be in five-digit groups. In decipherment, i the ciphertext tetra- 

nome is deciphered in the manner of the usual fow-square matrix, and 

lip' 

the location of the particular values for 6p andl^ will indicate tlie 



Identity of the third plaintext letter, if any, i 

I ■ 

1. Now that the student has become familiar with the details of 
typical polygraphic substitution systems, he is -ready to continue his 
crypt analytic study with the treatment of methods for recognizing poly- 
graphic substitution; these methods are described in the next paragraph. 



6t. Methods for recognizing polygraphic substitution . — a. The 
methods used to determine whether a given cryptogram is digraphic in 
character are usually rather simple. If there are many repetitions In 
a cryptogram or a set of cryptograms and yet the uniliteral frequency 
distribution gives no clear-cut Indications of mdnoalphabetlcity; if 
most of the repetitions contain an even number of letters and these 
repetitions for the most part begin on ' he odd- lejtters and end on the 
even letters of the message, yet the cipher text does not yield to so- 
lution as a blliteral cipher when the procedures butllned in Sections 
VII and VIII are applied to it; if the cryptograms usually contain an 
even ntmiber of letters (exclusive of niills); and if the cipher text is 
in letters and all 26 letters are not present and| J or U are among the 
absent letters (or if the cipher is in digits and| there is a -limitation 
in the range of the text v/hen divided into trinomds, this- range usually 
being not greater than OOI-676); then the encipheiment may be assumed to 
be digraphic in nature. - l - . 



b. Aithoiigh- the foregoing general remarks a±e true as far as they 

go, occasionally they may be difficult to apply with any clear-cut 
resvilts Tjnless a large volume of cipher text is available for study. To 
supplement them there are statistical tests which jmay be applied for the 
recognition of digraphic substitution. Just as tlie test and the A 
test may be applied to the unillteral distribution of a cryptogram to 
help determine whether it is monoalphabetic with ijespect to single- 
letter plaintext units, so may these same tests be, applied to the dl - 
graphic distribution of a cryptogram for the purpbse of detehnining 
whether the cryptogram in question is monoalphabetic when considered as 
a digraphic cipher, 1 

c. The basic form of the (j> test is the same when applied to di-; 
graphic distributions as when applied to monographic — that is, uini- 
literal- -distributions (see par. 27). It is only the plain and random 
constants that change, and "N" in the forraulaa now pertains to .the number 
of digraphs under consideration, instead of the number of single letters. 
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To lllxistrate this, the formulas for < 2 oniputing the "dlgraphic phi plain 
(^p)" and the "dlgraphic phi random shown helow:^^ 

r .0069 N(N-l) 

= .0015 N(H-l) 

The "dlgraphic phi observed (^q)" is calculated In the usual manner, that 
is, by multiplying each f (idilch in this case is found in one of the 
cells of a dlgraphic distribution) by f- 1 , and then totalling all the 
values thus derived. 

\d. The test (or the "dlgraphic blank-expectation test") maybe 
applied to a dlgraphic distribution Just as easily as its monographic 
counterpart is applied to a unlliteral frequency distribution. For this 
purpose. Chart 8 is given below, showing the average ixunOser of blanks 
theoretically expected in dlgraphic distributions for plain text and for 
random text containing various nu&ibers of digraphs (up to 200 digraphs). 
As can be seen, the chart contains two curves . The one labeled P applies 
to the average nuitlber of blanks iheoretlcally expected in dlgraphic 
distributions based upon normal plaintext messages containing the indi- 
cated number of digraphs. The other curve, labeled B, applies to the 
average nuniber of blanks theoretically expected in dlgraphic distrl- 



15 

The dlgraphic plain constant, .OO69, was obtained by sxjmming the 
squads of the probabilities of digraphs in English plain text; the 
dlgraphic random constant, .OOI9, is merely the decimal equivalent of 
1/676. Further elaboration on the use of these constants, among others, 
will be given in Military Cryptanalysis, Part II. 
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Number of digraphs in message. I 

I 

I 

Chart 8. j 

hutions hased upon perfectly random assortments of j digraphs. In using 
this chart one finds the point of intersection of -^e vertical coordi- 
nate corresponding to the nuniber of digraphs in th^ message, irith the 
horizontal coordinate corresponding to the ohserved nunher of hlanlcs in 
the dlgraphlc distrlhution for the message. If this point of Inter- 
section falls closer to curve P than it does to cvuhre R, this is evidence 
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that the cryptogram is dlgraphlc in nature^^; if it falls closer to 
ciirve R than to curve P, this is evidence that the cryptogram is not 
digraphic in characterT 

e. Althoiigh it may not he necessary, to resort to the \ise of the 

2 ""2 

4 and A test to determine whether or not a partictxlar cryptogram has 
been digraphically enciphered, it is veil to l030V the application of 
these tests, since use has been made of them in difficult cases in 
operational practice. They may be helpfully eniployed in cases where the 
cryptanalyst is uncertain as to whether or not a single null has been 
added at the beginning of a cryptogram suspected to be a dlgraphlc 
cljdier; and these tests may also be found useful in the analysis of com- . 
plex cases where the dlgraphlc encipherment has been applied, not to 
adjacent letters of the plaintext message, but to digraphs composed of 
more-or-less separated letters in the message. Elaboratloxis of these 
ideas will be treated in Military Cryptanalysis, Part -’ll. 

f. As for the recognition of trigraphic sxibstltutlon ciphers— if 
most of the repetitions are a multiple of three letters ° in length, if 
these repetitions for the most part begin (when the cipher text is 
divided into trlgraphs) with the first letters and end with the third 
letters of the trlgraphs , and if the length of 'the ciryptograms is for 
the^ most part a multiple of three letters, yet the cipher text does not 
yield to solution as a trlllteral cipher, 'then the encipherment may be 
assumed to be trlgraphic in nature. 

t 

£. Just as the 4 test may be used as an aid in the recognition of 
digraphicity, it may theoretically be used for recognizing the trl- 
graphlc, tetragraphlc, etc., nature of cryptograms, but its use for 
these latter prxrposes is much more limited because of the ° large amount 
of text which would be required to permit a valid application of the 
pertinent polygraphic 4 test. 

68. Gehera;f procedure in the 'identification arid" analysis of poly - 
graphic substitution ciphers .— ' Certain systems wixicfai at :^lrst glance 
seem to be polygraphic, in that~grot;q>ing8 of plaintext letters are 
treated as vinlts, are on closer inspection seen to be only partly poly- 
graphic in character. Such is true of systems Involving large tables of 
the type Illustrated in Figs. 47a and b, and 48 (in par. 6?,' above), 

o 



Unfortiinately, such would also be the case if the cryptogram under 
consideration were a polyalphabetlc cipher ii^lving two alphabets. 
Hbwever, to distinguish between a dlgraphlc cipher and a polyalphabetlc 
cipher with, two alphabets, a dlgraphlc distribution could be made "off 
the cut", that is, made of those ciphertext digraphs which are formed by 
omitting the first letter of text and then dividing the remaining text 
into groups of two letters. If the system were dlgraphlc, such a dlstrl- 

butlon would exhibit a poor 4 q> If the system were a two-alphabet stCbstl- 

tut ion system, the 4o 'he as satisfactory as that of the regular 

distribution, talcen "on the cut”. 
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wherein encipherment is hy pairs hut one of the letters in each pair is 
enciphered monoalphahetically, making these systems only pseudo -poly- 
graphlc. For example, using the table in Figure any plaintext di- 
graph beginning with "A” must be enciphered by a ciphertext digraph 
beginning with "W”; any plaintext digraph beginnlpg with **B” must be 
enciphered by a ciphertext digraph beginning wlthj etc, A crypto- 
gram involving the use of this table may then be identified as such 
.merely from a study of the tinlliteral frequency distribution made on the 
initial letters of the cipher digraphs, since suqh a distribution would 
perforce be monoalphabetic ,17 



b. In certain other systems — namely, the four-square, two-square, 
and Playfair square systems of par, 66, above --th^ method of encipherment 
is by pairs, but the encipherments of the left-hand and right-hand 
members of the pairs show group relationships j this is not pseudo- 
polygraphic but, rather, partially -polygraphle , Cryptograms enciphered 
by means of systems of this latter type may not be readily identified as 
such merely through an examination of their cipher text, but their so- 
lution may be effected rather rapidly as soon as a few correct plaintext 
assTnnptlona have been made therein, A more detailed treatment of this ’ 
matter will be given in succeeding paragraphs of iihis section, 

c . The- analysis of cryptograms which have been produced by di- 
graphic substitution Is acconiplished largely by the application of the 

simple principles of frequency of digraphs,^® with the additional aid of 
dlgraphic Idlomorphs and such special circumstances as may be known to 
or suspected, by the cryptjanalyst , The latter refqr to peculiarities 
which may be the result of the particular method employed in obtaining 
the equivalents of the plaintext digraphs in the encrypting process, 
such as those mentioned in subpars , a and b , above , In general, if there 
is sufficient text to disclose the normal phenomena of repetition and 
idiomorphism, or if cribs are available to be used as an entering wedge,, 
solution will be feasible. The foregoing general ■ stateoents will be 
e:qpanded upon in the following two subparagraphs, !d and e, 

d. When a’ digraphic system' is enployed in regular service, there' 
is little. doubt that traffic will rapidly acctunulate to an amount more 
than sufficient to piermit of solution by simple principles of frequency. 
Sometimes only two or three long messages, or a half-dozen of average 
length, are sufficient. For with the identification of only. a few cipher 



^ For this purpose, the simplest and most economical way to obtain 
the unlliteral distributions for the initial and final letters of di- 
graphs is to make a dlgraphic distribution and then add the tallies in 
each row to yield the distribution for the Initial letters, and add -the 
tallies in each column to obtain tl« distribution !for the final letters , 
18 , i 

In this, connection, it "vrould be well for the student to familiarize 

himself with that portion of Appendix 2 which contains dlgraphic fre- 
quency data. i 
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digraphs , larger portions of messages may he read because the skeletons 
of words formed ft:om the' few high-frequency digraphs very definitely 
limit the valxxes that can he. Inserted for the intervening unidentified 
digraphs. For example, suppose that the plaintext digraphs RE, IN, ON, 
KD, NO, SI, NT, and TO are among those that have heen identified hy 
frequency considerations, corrohorated hy a tentatively identified long 
repetition; ^d suppose also that the enemy is known to he using a large 
table of 676 cells containing, digraphs showing reciprocal equivalence 
between plainte^ and ciphertext digraphs. Suppose the message begins 
as follows (in which the assumed values have heen inserted): 

XQ VO ZI LK AP 'OL ZX PV CK IK OL ' UK AT HH IK 

HD IN NT EE NT NO IN 

VL BN OZ BZ DY TY IE GI 

SI , ON TO . . 



The Initial words SECOND INFANTRY REGIMENT are readily recognized. 
Furthermore, if CKj,=GIp, then-GI^sCKp, which suggests ATTACK as the last 

word in the message beginning . - This fragment of the message may now he 
completely recovered: SECCdSD INFANTRY REGIMEOT NOT YET IN POSITION TO 
ATTACK ... 



e. • Just as the choice, of probable words in the solution of uni- 
literal systems is aided or limited by the positions of repe.ated letters 
(see subpar. 49d), so, in digraphlc ciphers, is the placing of cribs 
aided or limited by the positions of repeated digraphs . In this con- 
nection, several frequent words and phrases containing repeated digraphs 
have been tabvilated for the student's aid, and this list of digraphid 
idlomorphs is presented as Section D in Appendix 3 (q.v.). Thus, if one 
is confronted by a ciphertext message containing the following repeated 
sequence, (therefore likely .to represent an, entire word) 

■VI FW ' HM AZ .. FF FW RO 



he may refer to the appropriate section of Appendix 3 which will dis- 
close, on the basis of the idiomorphlc pattern ”AB — — — AB” starting 
with the second cipher digraph, that the underlying plaintext word may 
be RE ]^-F0 RC EM ^ T, among others. Once a good start has been made 
and a few words have been solved, subsequent work is quite sl^le and 
straightforward. A knoifledge of. enemy correspondence, including data 
regarding its most common words and phrases, is of as much assistance in 
breaking down digraphlc systems as it is in the solution of any other 
cryptosystems . 

f . In the case of trlgraphic substitution, analyslg is made con- 
siderably more cosg>lex by the large amount of traffic required, not only 
for the initial entries, but also for further e:q>loitation of the enter- 
ing wedges. In effect, the solution of a trigraphic system closely 
parallels the solution of the syllaba^ portion of a large two-part code; 
these techniques will be dlscvissed in Military Cryptanalysis, Part V. 
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69 . Analysis of fo-ur-sctuare matrix systems * — small- 
matrix methods illtostrated in paragraph 66, the encipherment is only 
partially digraphic because there are certain relationships between 
those plaintext digraphs which have common elements and 'their corre- 
sponding ciphertext digraphs, which will also have | common elements. For 
example, in the four-square matrix given in Fig. $3 . it will be noted 
that AAp=FTq, AFpsFOg, AI^sFMj,, AQpZFLc, and AVpSFI^. In each of these 

cases when Ap is the initial letter of the plainte:^ petir, the initial 

letter of the ciphertext equivalent is Fq, This, 6f course, is the 

direct resTilt of the method; it means that the encipherment is mono- 
alphabetic for the first half of each of these five; plaintext pairs. 

This relationship holds true for four other groups !of five pairs begin- 
ning with Apj in effect, there axe five cipher alphabets employed, not 

23 . Thus, this case differs from the case discussed under subpax. 68a 
only in that the monoalphabet icity is complete, not for half of ail the 
pairs but only among the members of certain groups jof pairs . In a true 



dlgraphlc system, such as a system making use of a 



1676 -cell randomized 



table, relationships of the foregoing type axe entirely absent, and for 
this reason such a system is cryptographiOally mor^ secinre than small- 
matrix systems. ! - - 

b. From the foregoing it is clear that when s|olution has progressed 

sufficiently to disclose a few values, the insertion of letters within 
the cells of the matrix to give the plaintext -ciphe|rtext relationships 
indicated by the solved values immediately leads to the disclosure of 
additional values. Thus, the solution of only a fw values soon leads to 
the breakdown of the entire matrix. . . | 

i 

c. The following example will serve to lllxxstirate the, procedure, 

( 1 ) lie^t the message be as follows:. 
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2 


3 


i 


6 


0 


7 


8 


9 


10 


11 


13 


13 


14 


15 


IS 


17 


IS 


19 


20 


21 

1 


22 


23 


24 


25 


20 


27 


28 


29 


30 


A. 


H 


F 


C 


A 


P 


G 


0 


Q 


I 


L 


B. 


S 


2. 


K 


M 


N- 


D 


U 


K 


E 


0 

1 


H 


Q 


N 


F 


B 


0 


R 


U 


N 


B. 


Q 


C 


L 


C 


H 


Q 


B 


Q 


B. 


F 


H 


M 


A 


F 


X 


S 


I 


0 


K 


0 


1 


Y 


F 


N 


S 


X 


M 


c 


G 


y 


c. 


2L 


I_ 


z. 


B. 


E 


JC 


A 


F 


D 


X 


L 


P 


M 


X 


H 


H 


R 


G 


K 


G 


1 

Q 


K 


A 


M. 


L 


JL 


E. 


A 


A 


JL, 


D. 




_0 




H 


M 


u 


E 


0 


R 


D 


C 


L 


T 


U 


F_ 


E 


A 




C 


G 


1 

■ 1 


N 


H. 


F 


2L 


I 


iL 


2. 


J. 


.X 


E. 


F 


L 


B 


U 


Q 


F 


C 


H 


Q 


0 


Q 


M 


A 


F 


T 


X 


s 


Y 


C 


B 


E 


P 


F 


N 


B_ 


s 


JL 


j 


N 


u- 


F. ; 


Q 


I 


T 


X 


E 


U 




M 


ii. 


F 


-E. 


A 


A 


i 


A. 


0 


j 


E 


U 


E 




P 


I 


A 


N 


Y 


T 


F 


L 


B 


G. 


F 


E 


E 


P 


I 


D 


H 


P 


C 


G 


N 


Q 


I 


H 


B_ 


F 


iL 


J 


H 


F 


X 


C 


K 


U 


P 


D 


G 


Q 


P 


N. 


H. 


C 


B 


C 


Q 


L 


Q 


P 


N 


F 


N 


P 


N 


I 


T 


0 


R 


T 


E 


N 


c. 


P 


B 


C 


N 


T_ 


F 


iL 


H 


_A 


JU 


J. 




ii. 


A 




I 


A 


_A 


I 


A 


U 


C 


H 


T 


2 


C 


B 


I 


F 


G 


W 


1 

K 


F 


C 


■Q 


S 


L 


Q 


M 


C 


B 



K. 0 Y C R Q 

L. I R C G G 

M. L Q C I 



Q D P R X F N 0 M L F I D G C 

GNDLN OZTFG EERRP 
AAIOU CHI P 



CGI 
i F-H 
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(2) The cipher havlxig heen tested for standard alphabets (by the 
method of con^letlng the plain-component sequence) and found to give 
negative results, a unillteral frequency distribution is made* It is as 
follows : 




A B C D 



11 U» S 



g- 

- I 6S S I 

g g g g g 
g g g g g 
g g g g g 
E F G H 1 




Sggggggg^ 

ggggggggg 

JKLMN'OPQRS 



IS jo 17 is S 4 0 8 M U IS U IS 83 0 8 



g g g 

g g ^ g g $ 

T U V W X Y Z 

11 11 0 1 u 7 s 




(3) At first glance this may a;^ear to the untrained eye to be a 
monoalphabetic frequency distribution, but upon closer inspection it is 
noted that, aside from the frequencies of four or five letters, the 
frequencies for the remaining letters are not very dissimilar. There 
are, in reality, no very marked crests and trou^d^ — certainly not as many 
as would be e:qpected in a monoalphabe€ic suibstltution cipher of equal 
length. The ^ test, if taken (this test, as a rule,, is not necessary 
with samples of text of sizes such as this), would show unsatisfactory 
results (^qs6o 8U, as against 57870 and (^,^=4243) . 

(4) The message is carefully examined for repetitions of 4 or more 
letters , and all of them are listed: 



Frequency Located in lines 



TFHHAYZLQOIAAIQUCETF (20 lettbrs) 

QMLFEQQIGOI (ll letters)...... 

XIFBEX (6 letters).....* 

FEQQ* ...**......**.**.**.* *«.. '. • #w .*..,** 

CjMLF.. 



BFHM 

BSPK 

GOIH 



2 

2 

2 

3 

3 

2 

2 

2 



E and L. 
C and F. 
C and D. 
. ■ C , D, F *, 
C, F, K. 
B and G. 
A and E. 
D and K. 



Since there are quite a few repetitions, two of considerable length, 
since all but one of them contain an even number of letters, since these 
repetitions with but two exceptions begin on odd letters and end on even 
letters, and since the message also contains an even number of letters 
(344), the cryptogram is retranscribed into 2-letter groups for further 
study. It is as follows: 
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JL JL AJJU/ 



Message transcribed in pairs 





1 


s 


8 


4 


8 


a 


7 


8 


8 


10 


11 


18 


18 


14 


M 


A. 


HF 


CA 


PG 


OQ 


IL 


BS 


PK 


MN 


DU 


KE 


OH 


ON* 


FB 


OR 


UN 


B. 


QC 


LC 


HQ 


BQ 


BF 


HM 


AF 


XS 


10 


m 


QY 


FN 


SX 


MC 


GY 


C. 


XI 


FB 


EX 


AF 


DX 


LP 


MX 


HH 


RG 


KG 


QK 


QM 


LF 


EQ 


QI» 


D. 


^GO 


, ,IH 


MU 


EO 


RD 


CL 


TU 


FE 


QQ 


CG 


ON 


HP 


xE 


FB 


EX 


4 

E. 


FL 


BU 


QF 


CH 


QO 


QM 


AF 


TX 


SY 


CB 


ef[ 


FN 


BS 


PK 


NU 


F. 


QI 


TX 


EU 


QM 


LF 


EQ • 


QI 


GO 


_IE 


UE 


HPi 

1 


lA 


NY 


TF 


LB 


G. 


FE 


EP 


ID 


HP 


CG 


NQ 


IH 


BF 


HM 


HF 


1 

XC 


KU 


PD 


GQ 


PN 


H. 


CB 


CQ 


LQ 


PN 


FN 


PN 


IT 


OR 


TE 


NC 


H 


CN 


TF 


HH 


_AY^ 


J., 




jac. 


lA 


AI 


J3H. 


CH 


_TP 


CB 


IF 


GV 


KF 

1 


CQ 


SL 


QM 


CB 


K. 


OY 


CR 


QQ 


DP 


RX 


FN 


QM 


LF 


ID 


GC 


. cg| 


10 


GO 


IH 


HF* 


L. 


IR 


CG 


GG 


ND 


LN 


OZ 


TF 


GE 


ER 


RP 


IF 


HO 


TF. 


HH 




M, 




-92. 


lA 


AI 


_9LL 


CH 


TP 








i 











It is noted that all the repetitions listed above break up properly into 
digraphs except in one case^ viz., FEQQ in lines and F« This 

latter seems rather strange, and at first thou^t one might sxippose tha.t 
a letter vas dropped out or vas added in the vicinity of the FEQQ in 
line B « But It may be assnmed that the FE QQ in line B has no relation 
at all to the .F EQ Q« in lines C and F and Is merely an accidental repe- 
tition. j 

(^) A dlgraphlc dlsinrlbutlon is made as foUontrs: 
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Figure 60. 



(6) The appearance of the foregoing distribution for this message 
is quite characteristic of that for a dlgraphic substitution cipher. 
Althou^ there are 676 possible digraphs, only IO7 are present in the 
distribution; this parallels what is expected of normal plain text, since 
out of the 676 possible two-letter combinations (including "impossible 
plaintext digraphs" sUch as QQ, JK, etc., which might have been used for 
special Indicators, punctuation marks, etc.) only about 300 are usually 
used in the construction of plain text. ^9 The number of blank cells. 



The 300 most frequent digraphs comprise 95^ of normal English plain 
text (Appendix 2, Table 7-^0 • 
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■ 1 

569 f closely approximates the ^$9 vhlch vould he : expected' in a dlstri- 
Initlon made on a sample of plain text, of this siie, as shown hy Chart 6. 
Furthermore, although there are many cases in which a digraph appears 
only once, there are quite a few in which a digraph appears two or three 
times, fo\xr cases in which a digraph appears four times, one case in 
which a digraph appears five times, and one in wiich a digraph appears 
six times , All of the foregoing ohseivations concerning the distribution 
are reflected by the 4 test: the obse:i^ed digraphic phi value, 210, 
compares very favorably with the expected plain !v^ue ( r .OO69 x 172 x 
171 = 203) as against the expected random value (=.0019 3C 172 x 171 = 
h4) , Thus all indications point to a digraphlc substitution system. 

(7) Since neither the 4o (l760) and Aq (4)ifor the initial letters^ 

of the cipher digraphs nor the 4o (1^9^) Ao ^ final 

letters are too satisfactory in their approximation to the valvies ex- 
pected for monoalphabetlc distributions (4p-19^2|and 4r=^^3; Ap=9 and 

A 'the possibility of a pseudo -digraphic system is ruled out. There 

remain the possibilities of a partially -digraphic system employing a 
small matrix, or a true digraphlc system employidg a large, randomized 
table. In one common type of small-matrix system, the Playfair cipher, 
one of the telltale indications besides the absence of (usucdly) the 
letter J is the absence of cipher doublets, that 'is, two successive 
identical cipher letters . The occurrence of the double letters GO, HH, 
and QQ in the message \mder investigation ellmitkates the possibility of 
its being a normal Playfair cipher.. For •want of :more accurate dlagzu>stlc 

criteria ^ at this stage ,^^ the simplest thing -^o assume, from among the 
various hypotheses that remain to be considered, jis that a four-square 
• matrix is involved. One with normal alphabets being the slnplest 
case) in Sections 1 and 2 is therefore set down (Figure 6la) . 



20 



Even a medical practitioner often cannot successfully diagnose a 



condition on the first visit. Cryptanalytically 



on our "first visit". Subsequent probing will, ye hope, reject or 



stantiate this or that hypothesis or assunptlon, 
cipher text) is recovered (l.e., brought back to 
21 

However, see the treatment on the diagnosis 
digraphlc systems in subpar 73J.. 



speaking, we are still 



until the patient 
plain text) . 



sub 7 
(the 



of various types of 



i 

I 

I 

( 

I 

I 

i 

i 

I 

I 

j 

i 
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Figure Ola. 

(8) The recurrence of the c^oup QMLF| three tines, and at Intervals . 
suggesting that It nl^t he a sentence separator, leads to the assumption 
that It represents the word STOP. The letters Q, M, L, axid F are there- 
fore Inserted in the appropriate cells In Sections 3 a^ h of the diagram. 
Thtw (Fig. 6lh)t 




These placements seem rather good from the standpoint that keyword-nixed 
sequences may have been used In these two sections. Moreover, In Section 
3 the number of cells betweeh L and Q Is Just one less than enough to 
contain all. the letters M to P, Inclusive; this staggests that one of 
these letters,, probably N or 0, Is In the keyword portion of the sequence; 



179 

































I 



th^ tBf near the top of Section 3* Without maki|ng a commitment In the 
matter, let us suppose that M follovs L and that IP precedes Qj then let 
both N and 6, for the present, be Inserted in the! cell between M and P. 
Thus (Fig. 6lc)t I 



A 


B 


C 


D 


E 










1 


F 


G 


H 


I-J 


K 










i 


L 


M 


M 


0 


P 










IL 

1 


Q 


R 


S 


T 


U 


M 




P 


Q 


1 

1 

1 


V 


W 


X 


Y 


Z 










( 

1 

t 












A 


B 


C 


D 


jE 












F 


G 


H 


I-J 


|k 








■ F 




L 


M 


N 


0 








M 






.Q 


R 


S 


T 














V. 


W 


X 


Y 


iz 



- - Figure 6lc, 

(9) Now, ^ the placement of F in Section 3 ^s corrrot, the cipher 
equivalent of THp will be F6 q, and there should be a group of adequate 

frequency to correspond. Noting that occurs three times, it Is as> 
stimed to represent TEp and the letter N Is Inserte'd In the appropriate 

cell in Section k. Thus (Fig. 6ld): { . 

. ‘i - 
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(10) 


It 


is about time to try out these assumed values in the 


message 


The proper insertions are made, 


with the 


following results! 








1 


2 


s 


4 


5 


a 


7 


8 


9 


10 


11 


* « 


13 


14 


15 


A. 


HF 


CA 


PG 


OQ 


IL 


BS. 


PK 


MN 


DU 


KE 


OH 


QN 


■FB 


OR 


UN ' 


B. 


QC 


LC 


HQ 


BQ 


BF 


HM 


AF 


XS 


10 


KO 


QY 


FN 


5X 


MC 


GY 


C. 


XI 


FB 


EX 


AF 


DX 


LP 


MX 


HH 


RG 


KG 


QK 


QM 


LF 


EQ 




























ST 


OP 






D. 




-IH 


MU 


EO 


RD 


CL 


TU 


FE 


QQ 


CG 


QN 


HF 


tL. 


FB 


EX 


E. 


FL 


BU 


QF 


CH 


QO 


QM 


AF 


TX 


SY 


CB 


EP 


FN 


BS 


PK 


NU 














ST 




















F. 


QI 


TX 


EU 


QM 


LF 


EQ 


_QI_ 


GO 


IE 


UE 


HP 


lA 


NY 


TF 


LB 










ST 


OP 






















G. 


FE 


EP 


ID 


HP 


CG 


NQ 


IH 


BF 


HM 


HF 


XC 


KU 


PD 


GQ 


PN 
































TH 


H. 


CB 


CQ 


LQ 


PN 


FN 


PN 


IT 


OR 


TE 


NC- 


CB 


CN 


TF 


HH 


-AY-t 










TH 




TH 




















J. 


<Zk. 




lA 


AI 


_Q!L 


CH 


TP 


CB 


IF 


GW 


KF 


CQ 


SL 


QM 


CB 






























ST 




K. 


OY 


OR 


QQ 


DP 


RX 


FN 


QM 


LF 


ID 


GC 


CG 


10 


GO 


IH 


HF 
















ST 


OP 
















L, 


IR 


CG 


GG 


ND 


LN 


OZ 


TF 


GE 


ER 


RP 


IF 


HO 


TF 


HH 


AY, 


M. 




_SC_ 


lA 


AI 


_fiy_ 


CH 


TP 






- 













(u) So far no linposslble coniblnatlons are in evidence. Beginning 
vlth group In the message Is seen the follovlxig sequence: 



P K F N -P N 
T H . . T H 

Assume It to he THAT TEE. Then and the letter N Is to he In- 

serted In row U column 1 of Section 4. But this Is Inconsistent with 
previous assumptions, since N In Section 4 has alreeidy heen tentatively 
placed In rovr 2 coltunn 4. Other assumptions for FN^. are made: that It 

is, ISp (THIS TH...); that it is EHp (THEN TH...); hut the same incon- 
sistency is apparent. In fact the student will see that must re- 
present a digraph ending In F, G, H, I-J, or K, since N^ Is tentatively 
located on the same line as these letters In Section 2. Now FN^ occurs 
4 times In the message. The digraph It represents must he one of the 
following: 



DP, DG, DH, DI, DJ, DK 
IP, IG, IH, II, IJ, IK 
JF, JG, JH, JI, JJ, JK 



OF, OG, OH, 01, OJ, 

TK, 

IP, IG, IH, n, YJ, IK 
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Of these the only one likely to he repeated 4 times jis OF, yielding 

• » I 

‘ I 

P N F N P N i 

T H 0 F T H which may he a part of j 

CQLQPNFNPNIT ' CQLQPNFNPNIT 
.WORTHOFTHE; .SOUTHOFTHE. 

In either case, the position of the F in Section. 3 4^ excellent: 

F . . . L in row 3* There are 3 cells intervening lietween F and L, into 
which G, H, I-J, and K may he inserted. It is not nearly so likely that 
G, H, and K are in the keyword as that I should he i't* Lst it he 
asstuned that this is the case, and let the letters Gr, H, and -K he placed* 
in the appropriate cells in Section 3- Thus (Fig. 6le): 




Figurh 6le. 



Let the resultant derived values he checked eigainst jthe frequency dis- 
trlhution. If the position of H in Section 3 is cojjrect, then the di- 
graph ONp, normally of high frequency, ’ should he represented several 

times hy Wq . Reference to Fig . 60 shows to have a frequency of 4 , 
And ID'Iq, with 2 occ\irrences , represents NSp, There 1 is no need to go. 
through all the possible corroborations. 

P N F N P H 

( 12 ) Going hack to the assumption that T H , , T H is part of the 
e:cpression ; 



C QLQPHFRPKIT 
.NORTHOFTHE . 



CQLQPNFNPHIT 

.SOUTHOFTHE 



it is seen at once ■ from Fig . 6le that the latter is [apparently correct 
and not the former, because Ifi^ equals OUp and not 'If OSp=CQg, this 
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REF ID:A66790 




RESTRICTED 

means that the letter C of the digraph CQ^ must he. placed in row 1 column 
3 or row 2 column 3 of Section 3» Now the digraph CB^. occurs 5 times, 
CGq, It- times, CHq, 3 times, CQ^, 2 times. Let an attempt he made to 

deduce the exact position of C in Section 3 aocL the positions of B, G, 
and H in Section 4, Since F is already placed in Section 4, assume G 
and H directly follow it, and that B comes before it. How much before? 
Suppose a trial he made. Thus (Flg.,6lf): 



A 


B 


C 


D 


E 






C? 






F 


G 


H • 




K 




- 


C? 






L 


M 


N 


0 


P 


F 


G 


H 


K 


L 


Q 


R 


S. 


T 


U 


M 


8 


P 


Q 




V 


W 


X 


y 


Z 






















A 


B 


C 


D 


E 








N 




F 


G 


H 


I-J 


K 




B? 


B? 


F 


6 


L 


M 


N 


0 


P 


H 




M 


Q 




Q 


R 


S 


T 


U 












V 


W 


X 


Y 


Z 



Figtire 6lf. 



By referring now to the frequency distribution. Fig. 60, after a very 
few minutes of experimentation it becomes apparent that the following is 
correct ; 



A 


B 


C 


D 


E 






c 






F 


G 


H 




K 












L 


M 


N 


0 


P 


F 


G 


H 


K 


L 


Q 


R 


S 


T 


U 


M 


N 

0 


P 


Q 




V 


W 


X 


Y 


z 






















A 


B 


C 


D 


E 


Je. 






N 




F 


G 


H 


I-J 


K 


B 






LZL 


G 


L 


M 


N 


0 


P 


H 




M 


Q 






R 


S 


T 


U 












V 


W 


X 


y 


Z 



Figure 6lg. 
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(13) The identifications given "by these placements are inserted in 
the text, and solution is very rapidly completed. The fijaal matrix and 
deciphered text are given below. ! 



A 


B 


C 


D 


E 


S 


0 


C 


I 


E 


F 


G 


H 


I-J 


K 


T 


Y 


A 


B 


D 


L 


M 


N 


0 


P 


F 


G 


H 


K 


L 


Q 


R 


S 


T 


U 


M 


N 


P 


Q, 


R 


V 


W 


X 


Y 


Z 


U 


V 


W 


X 


Z 


E 


X 


p 


U 


,L 


A 


B 


C 


D 


E 


S 


I 


0 


N 


A 


F 


G 


H 


I-J 


K 


B 


c 


D 


F 


G 


L 


M 


N 


0 


P 


H 


K 


M 


Q 


R 


Q 


R 


S 


T 


U 


T 


V 


w 


y 


Z 


V 


W 


X 


Y 


Z 



Figure 6lh. 



A. 


H 


F 


C 


A 


P 


G 


0 


Q 


I 


L 


B 


S 


P 


K 


M 


N 


D 


U 


K 


E 


0 


H 


Q 


N 


F 


B 


0 


R 


U 


N 




0 


N 


E 


H 


u 


N 


D 


R 


E 


D 


F 


I 


R 


S 


T 


F 


I 


E 


L 


D 


A 




T 


I 


L 


L 


E 


R 


Y 


F 


B. 


Q 


C 


L 


C 


H 


Q 


B 


Q 


B 


F 


H 


M 


A 


F 


X 


S 


I 


0 


K 


0 


Q i 


F 


N 


S 


X 


M 


C 


G 


Y 




R 


0 


M 


P 


0 


S 


I 


T 


I 


0 


N 


S 


I 


N 


V 


I 


C 


I 


N 


I 


T 




0 


F 


B 


A 


R 


L 


0 


w- 


C. 


X 


I 


F 


B 


E 


X 


A 


F 


D 


X 


L 


P 


M 


X 


H 


H 


R 


G 


K 


G 


Q 


k 


Q 


M 


L 


F 


E 


Q Q 


I 




w 


I 


L 


L 


B 


E 


I 


N 


G 


E 


N 


E 


R 


A 


L 


S 


U 


P 


P' 


0 


R 


T 


S 


T 


0 


P 


D 


U 


R 


I 


D. 


G 


0 


I 


H 


M 


U 


E 


0 


R 


D 


C 


L 


T 


U 


F 


E 


Q 


Q 


C 


G 


Q 


1 

N 


H 


F 


X 


I 


F 


B 


E 


X 




N 


G 


A 


T 


T 


A 


C 


K 


S 


P 


E 


C 


I 


A 


L 


A 


T 


T 


E 


N 


T 


i 

1 


0 


N 


w 


I 


L 


L 


B 


E 


E. 


F 


L 


B 


U 


Q 


F 


C 


H 


Q 


0 


Q 


M 


A 


F 


T 


X 


S 


Y 


C 


B 


E 


1 

If 


F 


N 


B 


S 


P 


K 


N 


U 




P 


A 


I 


D 


T 


0 


A 


S 


S 


I 


S 


T 


I 


N 


G 


A 


D 


V 


A 


N 


C 




0 


F 


F 


I 


R 


S 


T 


B 


F. 


Q 


I 


T 


X 


E 


U 


Q 


M 


L 


F 


E 


Q 


Q 


I 


G 


0 


I 


E 


U 


E 


H 


p 


I 


A 


N 


Y 


T 


F 


L 


B 




R 


I 


G 


A 


D 


E 


S 


T 


0 


P 


D 


U 


R 


I 


N 


G 


A 


D 


V 


A 


N 


c 


E 


I 


T 


W 


I 


L 


L 


P 


G. 


F 


E 


E 


P 


I 


D 


H 


P 


C 


G 


N 


Q 


I 


H 


B 


F 


H 


M 


H 


F 


X 


d 


K 


U 


P 


D 


G 


Q 


P 


N 




L 


A 


C 


E 


C 


0 


N 


C 


E 


N 


T 


R 


A 


T 


I 


0 

V 


N 


S 


0 


N 


w 


6 


0 


D 


S 


N 


0 


R 


T 


H 


H. 


C 


B 


C 


Q 


L 


Q 


P 


N 


F 


N 


P 


N 


I 


T 


0 


R 


T 


E 


N 


C 


c 


! 

B 


C 


N 


T 


F 


H 


H 


A 


Y 




A 


N 


D 


s 


0 


U 


T 


H 


0 


F 


T 


H 


A 


Y 


E 


R 


F 


A 


R 


M 


A 


N 


D 


H 


I 


L 


L 


S 


I 


X 


J. 


Z 


L 


Q 


c 


I 


A 


A 


I 


Q 


U 


C 


H 


T 


P 


C 


B 


I 


F 


G 


W 


K 


F 


C 


Q 


S 


L 


Q 


M 


C 


B 




Z 


E 


R 


0 


E 


I 


G 


H 


T 


D 


A 


S 


H 


A 


A 


N 


D 


0 


N 


W 


0 


0 


D 


S 


E 


A 


S 


T 


A 


N 


K. 


0 


Y 


C 


R 


Q 


Q 


D 


P 


R 


X 


F 


N 


Q 


M 


L 


F 


I 


D 


G 


c 


C 


G 


I 


0 


G 


0 


I 


H 


H 


F 




D 


W 


E 


S 


T 


T 


H 


E 


R 


E 


0 


F 


S 


T 


0 


P 


C 


0 


M 


M 


E 


k 


C 


I 


N 


G 


A 


T 


0 


N 


L. 


I 


R 


C 


G 


G 


G 


N 


D 


L 


N 


0 


Z 


T 


F 


G 


E 


E 


R 


R 


P 


I 


1 

F 


H 


0 


T 


F 


H 


H 


A 


Y 




E 


T 


E 


N 


P 


M 


S 


M 


0 


K 


E 


W 


I 


L 


L 


B 


E 


U 


S 


E 


D 


0 


N 


H 


I 


L 


L 


S 


I 


X 


M. 


Z 


L 


Q 


C 


I 


A 


A 


I 


Q 


U 


C 


H 


T 


P 
















j 




















Z 


E 


R 


0 


E 


I 


G 


H 


T 


D 


A 


S 


H 


A 
















! 
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d. In the solution of four-square cryptograms advantage may he 
taken not only of the general 'type of digraphic -idioinorphs mentioned in 
suhpar, 6Se, above, but also of a special type of partial idiomorphism 
present in any four-sqxaare cryptograms involving the use of a matrix in 
which the plain components consist of normal alphabets normally in- 
scribed.^^ As an illustration, let the digraphs SCt UT, (H.) be enciphered 

■ by means of any four-square having normal' alphabets in Sections 1 and 2, 
and it will-.be found that in the encipherment the initial letter of the 

cipher digraph representing SOp 'will be identical to the initial letter 
of the cipher digraph representing UTp, regardless of'how.the cipher com- 
ponents are constructed. On this basis, a brief list 'of specialized 
single -letter patterns have been compiled for use in the solution of such 
a digraphic system; this list of "four-square digraphic idiomorphs" con- 
stitutes Section F of Appendix 3* ' ' 

e. It is Interesting to note how much simpler the technique of 
analysis is in the case .of so-called inverse four-square ciphers, which 
involve the use of ,a matrix wherein .the ciphertext sections contain normal, 
alphabets, the plain components being mixed. For exe^le, referring to 
Fig* 53 > suppose that Sections 3. and h are used as the source of the 
plaintext pairs, and Sections 1 and 2 as the source of the ciphertext 
pairs; then ONp=ETc, EHprGEg,’ etc. The simplici-ty of the analytic pro- 
cedure will be made clear by the following exposition. 

(1) To solve a message enciphered with an inverse four-square matrix, 
it is necessasry to perform -two steps . First, convert the ciphertext pairs 
into their plain-component equivalents by "deciphering" the message with a 
matrix in which all four sections contain normal alphabets; this operation 
yields two uniliteral substitution "ciphers", one composed of the odd 
letters, the other of the even letters. The second step is to solve these 
two monoalphabet ic portions. 

(2) As an example, let us consider the following cipher text, kno%m 
(or assumed) to have been encrypted with a trinome-digraphic^^ system 



If any other kno\m plain components were involved, the procedure of 
deriving a list of idiomorphic patterns -would be modified to fit the 
partictuLar case. 

2 ^ 

^ If the cipher text were being examined "from crypt analytic scratch", 
the limitations (003-595) of the cipher text when the latter is divided 
into trinomes for exaMnation would have at once indicated that this 
grouping is the one which merits detailed analysis. The (|>^ test would 
then give an indication of the digraphic nature of the underlying crypto- 
graphic treatment. 
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Incorporating a four-squEore matrix similar to that 



illustrated in Fig. 



except that the plain -component sections have been; changed: 



"2 0 3 2 3 

27835 
20805 
6 8 1 8 
2 U 3 0 2 
15313 

6 5 3 6 

47821 

08703 

00741 



85081 
4 1 8 0 4 
7 4 1 3 5 
33930 
83832 
6 1 0 4 1 

6 2 6 6 3 

7 3 9 3 3 
70914 
33381 



83450 
5 0 4 1 3 

35473 

91393 

28359 

0 0 14 4 
4 4 0 0 7 

81193 

19391 

3 3 5 9 3 



27934 
27416 
■32626. 
4 1 1 0 4 
38022 
10 10 1 
18345 
4 7 9 2.4 
11607 
3 .9 3 4 0 



11503 

33091 

91160 

41331 

6 i 0 4 3 
8 2 4 0 3 
b i 4 0 2 
0 4 0 3 2 
71371 
63531 

I 



09168 
01092 
03218 
17296 
69130 
3 6 1 6 8 
88152 
41306 
5 3 5 9 5 

88133 



(3) The first thing to be done is to construct a four-square matrix 
with the known ciphertext sections, and inscribe arbitrary alphabets in 
the plr ;ext seetioius^ ^ follows: i 



A 


B 


G- 


D' 


E 


000 025 050 075 1001 


F 


G 


H. 


I, 


K 


125 150 ' 175 


200 225 


L 


M 


H 


0. 


P 


250 275 300 325 350 


Q 


R 


S; 


T 


U 


375 400 425 450 475 


V 


W 


X 


Y 


Z 


500 525 550 575 600 




1 


2 


3 


4 


A 


B 


C 


D. E 


5 


6 


7 


8 


9 


F 


G 


H 


l! K 


10* 


11 


12 


13 


l 4 


L 


M 


N 


Oi P 


15 


16 


17 


18 


19 


Q 


R 


S 


T U 


20 


21 


22 


23 


24 


V 


W 


X 


y! z 



( 4 ) The cipher text is then written in trinomes, and these- tsHinomes 



are "deciphered” by means of the foregoing matrix, 
cipher text as follows: 



yielding the' converted 
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5 - . ■ 10 ^ 



A 


.. 203 


238 


508 


183 


450 


VO 


'• 34 i 


150 


309 


168 


278 


354 


180 


450 


4 i 3 




“ ID 


IP 


'YF 


IH 


QD 


PB 




ra . 


PH 


IR 


OB 


PE 


FH' 


OP 


m 


B 


274 


i 63 ‘ 


309 


101 


092 


208 


657 


4 i 3 


53‘5 


473 


326 


269 


116 


003 


218 




PV 


m 


PH 


BE 


CT 


II 


CH 


TM 


VM 


TY 


MD 


PQ 


BU 


DA 


IT 


C 


468 


183 


393 


091 


393 


4 ll 


044 


133 


117 


296 


243 


028 


383 


228 


359 




TT 


IH 


TQ 


B^ 


TQ 




ER 

1 


IF 


cu 


MW 


lU 


DB 


TF 


IE 


PK 


D 


380 


226 


104 


369 


130 


153 


136 


104 


100 


l 44 


101 


018 


240 


336 


168 




OF 


GE 


EE 


PU 


FF 


IB 


GL 


EE 


AE 


KQ 


BE 


DQ 


FU ■ 


MO 


IR 


E 


465 


366 


266 


344 


007 


',183 


450 


l 40 


288 


152 


478 


217 


393 


381 


193 




QT 


MU 


MQ 


PT 


CF 


IH 


QD 


FQ 


OM 


HB 


TE 


B^ 


TQ 


RF 


IS 


F 


479 


240 


4 o 3 


24 i 


306 


087 


037 


091 


4 i 9 


391 


116 


077 


137 


153 


595 




UE 


FU 


TB 


GU 


MH 


CO 


CM 


BT,. 


UR 


RQ. 


BU 


CD 


HL 


IB 


VY 


G 


007 


413 


338 


133 


593 


393 


4 o 6 


353 


188 


133 














CF 


TM 


00 


IF 




TQ 


_RG 


OE 


IN 


IF 













The distributions of the letters constituting the initial letters and 
final letters of the converted digraphs are as- follovra: 



— H 2 H M 

(Initial Letters) ABC DEFGHIKLMNOPQRSTUVWXYZ 



= H S 5 = 

(Final Letters) ABCDEFGHIKLMioPQRSTUVWXYZ 



(5)-i^Using straightforward principles of frequency and partial idio- 
morphs,^ • the plain text (beginning with the openii^ words EHEMY 
RECOUNAISSAECE . , . ) is recovered, and the following equivalents are obtain 
ed for the- converted cipher letters of the two alphabets: 

(Initial Letters) C; ABCDEFGHIKLMROPQRSTUVWXYZ- 

P: B R A H-M S' C D EF- I LNOP TUV Y' 



(Final Letters) 



C: ABCDEFGHIKLMNOPQRSTUVWXYZ 

P: WA RERBCDF-HIKLMOPQSTUV Y 



Note the ABA pattern of the first word in the message (EREl^Y), made 
patent by the two-alphabet conversion process. Also note the S-i’old 
repetition (representing the plaintext word STOP) which, although hidden 
in the original cipher text, now comes to light, 

18 t 
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Keyword-mixed sequences directly manifest themselves -becaiuse the original 
enciphering matrix contained such sequences in Sections 1 and 2, inscribed 
in the same manner as were the arbitrary A-Z sequences which were used for 
the conversion. In fact, the key words of the two distributions might 
have been recovered from an analysis of the "profiles” of the distributions 
above, as described in subpar. ^4e. | 

(6) The original enciphering matrix is then reconstructed, thus: 



6 


R 


A 


H 


M 


000 


025 


050 


075 


100 


S 


C 


D 


E 


F 


125 


150 


175 


260 


225 


0 


I 


K 


L 


K 


250 


275 


300 


325 


350 


0 


P 


Q 


T 


U 


375 


400 


425 


450 


475 


V 


W 


X 


Y 


Z 


500 


525 


550 


575 


600 




1 


2 


3 


4 


V 


A 


0 




E 


5 


6 


7 


8 


9 


R. 


B 


C 


D 


F 


10 


11 


12 


13 


14 


H 


I 


K 


i 


M 


15 


16 


17 


18 


19 


0 


P 


Q 


s 


T 


20 


21 


22 


23 


24 


u 


V 


X 


Y 


Z 



(7) Although the example lllxistrated was that: of a numerical di- 
graphlc system, it is obvious that this technique! of solution also applies 
to literal foinr-square systems in which the cipher coniponents are known 
sequences. It should be clear to the student the | tremendous difference it 
makes when it is possible to convert a digraphlc system into a two-alphabet 
system; in a digraphic system, we are plagued by 4 potential 676 different 
elements in the cipher, whereas in a two-alphabet 1 system we still have 
only 26 elements (in each of two sets, it is truej in the cipher text to 
be solved. This principle of conversion of cipher text into a secondary 
cipher text has application in some of, the most cc^mplex types of crypto- 
systems; the student would do well to keep this in mind. 

(8) As a further observation on inverse four4square systems, it is 
pointed out that where the same mixed alphabet is ipresent in Sections 3 
and 4, the problem is still easier, since the letters resulting from the 
conversion into plain-conqoonent equivalents all belong to the same, single 
mixed alphabet; thus such a digraphic system is reduced to an ordinary 
simple substitution cipher. 

f . The solution of cryptograms enciphered by other types of small 
matrices is aceon^lished along lines very similar to those set forth in 
subparagraph c on the solution of a four-square cipher; this will be 
illustrated in subsequent paragraphs. There are, ; unfortunately, few means 
or tests which can be applied to deteimine in the ; early stages of the 
ansJLysls exactly what type of digraphic system is, involved in the first 
case under study. The author freely admits that ihe solution outlined in 
subparagraph £ is quite artificial in tliat nothing is demonstrated in step 
(7) that obviously leads to or warrants the assuoi>tion that a fo\nr-square 
matrix is involved. The point was passed over with the quite bald state- 
ment that this was "from amoiig the various hypotheses that remain to be 
considered"— and then the solution proceeded exactly as though this mere' 
hypothesis had been definitely established. For example, the very first 
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results obtained were based upon assming that a certain letter, repe- 
tition represented the word STOP and imniedlately inserting certain letters in 
appropriate cells in a four-square matrix with noncal sequences in Sec - 
tions 1 and 2 . Several more asstmqptions were built on top of that, and 
very rapid strides were made. What if it had not been a four-square 
matrix at all? What if it had been some other tjrpe of not readily identi- 
fiable digraphic system? The only defense that can be made of what may 
seem to the student to be purely arbitrary procedure based upon the 
author’s advance information or knowledge is the following: In the first 

place, in order to avoid making the explanation a too-long-drawn-out 
affair, it is necessary (and pedagogical experience warrants) that certain 
alternative hypotheses be passed over in silence. In the second place, 
it may now be added, after the principles and procedure- have been eluci- 
dated (which at this stage is the primary object of this text) that if 
good results do not follow from a first hypothesis, the only thing the 
cryp-tanalyst can do. is to reject that hypothesis and formulate a second 
hypothesis. In actual practice he may have to reject a second, third, 
fourth, .'. . nth hypothesis. In the end he may strike the right one— or he 
may not. There is no assurance of success in the matter. In the third 
place, one of the objects of this text is to show how certain crypto- 
systems, if enployed for military, purposes, can readily be broken down. 
Assuming that some type of dlgraphic system is in use, and’ that daily 
changes in key words are made, it is possible that the traffic of the 
first day might give considerable difficulty in solution if the specific 
type of dlgraphic system were not known to the cryptanalyst. But by the 
time two or three days’ traffic had accumulated it would be easy to solve, 
because probably by that time the cryptanalytic personnel would have suc- 
cessfully analysed the cryptosystem and thus learned what type of matrix 
or table the enemy is using. 

70 « Analysis of two-spyiare matrix systems .— a. Cryptosystems in- 
volving either vertical two-sq,uare or horizontal two-square matrices may 
be- identified as such and solved by capitalizing on the cryptographic pe- 
culiarities aM Idlosyncracies of these systems. It will be noted that, 
considering the mechanics of the cryptosystems, in vertical two-square 
matrices employing the normal enciphering convent ions, ^5 exactly 20^ of 
the 625 "possible" plaintext digraphs will be "transparent" (i.e., s«lf- 
enciphered) in cipher text; in horizon-tal two-square systems, exactly 2C^ 
of the 625 digraphs will be characterized by an "inverse transparency" 



25 

That is, for vertical two-square systems, digraphs are self -enciphered 
if ^ and 6^ fall in the same column In the matrix; and, for horizontal 
two-square systens, if and 0.1 are in the same row, the ciphertext di- 
graphs are the reversed plaintext digraphs. 
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(l.G., enciphered by the same digraphs reversed)., Therefore, If an 
examination of a cryptogram or a set of cryptogra|os discloses a goodly 
portion of vhat appear to he direct transparenclels (cipher digraphs which 
could well he plaintext digraphs), It may then hej assumed that a vertical 
two-square matrix has been used for the encryption. On the other hand. 

If a large number of cipher digraphs could he "gojsd" plaintext digraphs 
If the positions of the letters were reversed , thjen It may he assumed that 
the cryptosystem Involved a horizontal two-square matrix* Sanetlmes 
skeletons of words or even of whole phrases are sjslf -evident In such 

cipher text, thus affording an easy entering wedg^ Into the cryptosystem. 

1 

h . An exanple will best serve to llltistrate; the techniques of 
Identification and subsequent solution of a two-sjq.uare matrix cipher.' 

The following naval message Is to be studied: 



U 0 D L C 


E N 0 A N 


S I G L B 


B E I R I 


Ri C R G L 


N 


M 0 L C 


P T E P T 


R B B 0 E 


G P A B Q 


W R R K S 


li P C R M 


0 


0 R A P 


D E A .1 


A N X R A 


I E D A I 


R M A G B 


e! K H S L 


C 


D D L C 


T Q 0 R E 


R D T M D 


T I A Q F 


I E Q T A 


R R B F R 


0 


U 0 0 S 


S N R N R 


K T A S E 


S R H L P 


0 R R K S 


ll P C R C 


E 


R 0 1 S 


H L I R K 


P L 0 R 0 


R Z U C T 


A L T 0 I 


i: H 0 C R 


0 


CERA 


0 S D I N 


0 E E K R 


L C U B R 


A 0 S D I 


I; P D A R 


C 


0 G G R 


0 L H 0 C 


W D I L P 


0 I L R Q 


X D I G L 


R; B B Q Y 


F 


S S R A 



VYOIQRSLXX 

Preliminary steps In analysis are made according '%o the procedures alreeidy 
described in this text, and the hypothesis of monbgraphic, uniliteral en- 
cipherment (with either standard or mixed cipher lalphabets) has been re- 
jected. Multiliteral substitution, or dlgraphic substitution, comes next 



Althoiigh 625 "possible" plaintext digraphs are involved, the identity 
of digraphs actually used in plain text limit thi!s figiure considerably. 
Furthermore, the frequencies of the plaintext digraphs actually used come 
into consideration, in conjunction with the locatjion of the letters of 
these digraphs In any particular two-square matrix. Thus, from the crypt- 
analyst's standpoint, there are "excellent" two-sijuare matrices giving a 
high self -encipherment rate for high frequency pljaintext digraphs, and 
there are "poor" two-square matrices which have al potentially high self- 
encipherment rate only for those low frequency plaintext digraphs which 
may not occin: at all in a given cryptogram. 



I 
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Into consideration. The cipher text is written in digraphs, as follov;s: 



5 10 15 



B 


UO 


DL 


CE 


NO 


AN 


SI 


GL 


BB 


Ei 


RI 


RC 


RG 


LN 


MO 


LC 


B 


FT 


ER 


GR 


BB 


OE 


GP 


AB 


QW 


MN 


K5 


■ IP- 


■ CR 


MO 


OR 


AP 


C 


DE 


AM 


H<V 


(NK 


RA 


IE 


DA 


IR 


m 


GR 


EK 


BS 


LC 


DD 


LC 


D 


n 


OR 


EN 


>DT 


MD 


TI 


AQ 


FI 


£Q 


TA 


HN 


BF 


NO- 


-UO . 


OS 


E 


SN 


NN 


RK 


TA 


SE 


SN 


HL 


PO 


HN 


K5 


IP.’ 


CR 


CE~ 


kb 


IS 


1 


HL 


IR 


KP 


LO 


NO 


NZ 


UC 


TA 


LT 


01 


IH 


OC 


NO 


CE 


RA ^ 


1 


OS 


DI 


NO 


EE 


KR 


LC 


DB 


RA 


OS 


DI 


IP 


DA 


RC 


OG 


GR 




OL 


NO 


CW 


DI 


LP 


01 


"in 


QX 


DI 


GL 


RB 


BQ 


YF 


bs ' 


-RA 


i 


VY 


01 


OR 


SL 


XX 


















' 





Flgxire 62. . 



Noting the 8-letter repetition 90 letters apart, the 6 -letter repetition 
16 letters apart, and the 4-letter repetition at an interval of 220 let- 
ters, and that those repetitions begin on odd letters and end on even 
letters, credence is given to the grouping of the cipher text into pairs 
of letters. A dlgraphic distribution is then made, illustrated In. Eig:- 

63. . 
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11682022112 - 27110 13.7^»li83 - - 23 1 1 



Figure 63 . 

c. The 152 , Is most satisfactory when cbiapared with (10?) 

and ( 23 ) . Since the cryptogram has all the earmarks of a digraphic 

cipher, and no manifestations are found to supporjt the hypothesis of a 
multiliteral system, the next problem is the specific determination of the 
partic\ilar kind of digraphic system involved. Itl may be noted that there 
are quite a few digraphs in the ciplier text which! resemble good plaintext 
digraphs, proportionally more so than, for instanjce, in the cryptogram in 
subpar. 69 c; the cry-ptologic finger points to the; possibility of a two- 
square system. However, since the words "good dijgraphs" are ssrrjantically 
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elusive, let us attempt to determine statistically whether or not a two- 
square system might be involved' ahd, if a two-square, whether it is more 
probably a vertical or a horizontal two-square. 

d. First, for the piorpose of determining whether "direct trans- 
parencies" or "inverse transparencies" predominate in this cryptogrom, the 
digraphs of the distribution in Fig. 63 will be set down in tabular form, 
with an indication of their frequency in the -cryptogram, and with data 
relative to the probability of these digraphs as plaintext’ digraphs , and , 
as plaintext digraphs when reversed. In the table on page 19 ^, col. (l) 
is a listing of the ciphertext digraphs; col. ( 2 ) is the frequency of the 
ciphertext digraph as it occurs- in the cryptogram;’ col. ( 3 ) is the loga- 
rithm of the theoretical plaintext frequency of' the particular digraph 
(from Table I 5 , Appendix 2); col. (4) represents" the products' of the 
entries in cols. ( 2 ) and ( 3 ); col. ( 5 ) is the logarithm of the . theoretical 
plaintext frequency of the reversed digraph (from Table 15 , Appendix 2); 
and col. ( 6 ) represents the products, of the entries in cols. ( 2 ) and ( 5 )*' 
From this, the sum of the values in col. (4), 58*34, is taken to be the 
"direct transparency" -value, and the sura of the values in col. ( 6 ), 63 . 02 , 
is taken to be the "inverse transparency"; value. Thus, since this par- >' 
ticular cryptogram has an "inverse transparency" value which is’ higher 



27 -• ' 

The test to be described in the following subparagraphs is based on 

an evaluation of those instances wherein the observed frequency of any 
pstrticular ciphertext digraph approximates the frequency with which the 
particular digraph, or its reversal ,. would be expected to occur if con- - 
sidered as a plaintext digraph. Any such correlation which occurs. in a 
four-square or Playfair cipher, or in a cryptogram produced by a large 
randomized’ dlgraphic table, is purely accidental because it is not a 
result of the mechanics of the system. However, in two-square cryptograms 
such correlation ^ caused by the mechanics of the system in .the encipher- 
ment of 20 ^ of the possible plaintext digraphs, and these catisal instances 
of correlation occur in addition to any accidental instarices.'which inay 
arise in the encipherment of the remaining 80^. Thus, if a digraphic 
cipher exhibits merely the random expectation of correlation both when the 
particular ciphertext digraphs are considered as they are and vrhen their 
reversals are considered, the cryptogram may be assumed to involve a 
system other than two-square. If a digraphic cipher exhibits more. than 
the random expectation of correlation, either when the particular digraphs 
are considered direct or when considered reversed, it may be assumed to 
involve t'wo-square encipherment; and the part icuDar consideration — that of 
the digraphs direct or that of the digraphs reversed — ^which gives rjLse to 
the greater degree of correlation indicates. whether the cryptogram, in-volves 
a vertical two-square or a horizontal two-square, respectively. 
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I ■ 



a) 


(2) 


(3) 


(4) 


(5) 


(6) 


(1) 


(2) 


(3) 


(4) 


(5) 


(6) 


a> 


. (2) 


(8) 


(4) 


(5) 


(6) 


AB 


1 


..45 


.0.45, 


.38. 


0. 38 


HA 


1 


.67 


0.67 


.25 


0.25 


OR 


2 


.89 


1.78 


.74 


1.48 


AM 


1 


.61 


0. 61 


.78 


0.78 


HL 


2 


.13 


0.26 


.13 


0.26 


OS 


3- 


.61 


1.83 


.62 


1.86 


M 


1 


.89 


0.89 


.72 


0.72 


HS 


1 


.38 


0.38 


.72 


0.72 


PO 


1 


'.64 


0.64 


.72 


jO.72 


AP 


1 


.58 


0. 58 


.61 


0. 61 


IE 


1 


.59 


0.59 


.73 


0.73 


PT 


1 


.51 


0.51 


.25 


0.25 


AQ 


1 


.00 


0. 00 


.00 


0.00 


IH 


1 


.00 


0.00 


.77 


0.77 


QN 


1 


.00 


0. 00 


.00 


0. 00 


BB 


2 


.00 


0.00 


.00 


0. 00 


IP 


3 


.48 


1.44 


.45 


1.35 


OX 


1 


.00 


0. 00 


.00 


0. 00 


BF 


1 


.00 


0.00 


.00 


0.00 


IR 


2 


.73 


1.46 


.75 


1.50 


RA 


4 


.80 


3.20 


.82 


3.28 


BQ 


1 


' 1 


0.00 


.00 


0.00 


IS 


1 


.78 


0. 78 


-.77 


0.77 


RB 


1 


.25 


0.25 


.25 


0.25 


CE 


3 


.<6 


2.28 


.76 


2.28 


KP 


1 


.00 


0. 00 


.00 


0.00 


RC 


2 


.53 


1.06 


.38 


0.76 


CR 


2 


.38 


0.76 


.53 


1. 06 


KH 


1 


.00 


0. 00 


.13 


0.13 


RG 


1 


.48 


0.48 


.42 


0.42 


CW 


1 


.13 


0.13 


.00 


0.00 


KS 


2 


.13 


0.26 


.13 


0.26 


RI 


1 


.75 


0. 75 


;73 


0. 73 


DA 


2 


.76 


1.52 


.73 


1.46 


LC 


4 


.33 


1.32 


.42 


1.68 


RK 


1 


.13 


0.13 


.00 


0.00 


DD 


1 


.51 


0.51 


.51 


0. 51 


LN 


2 


.13 


0.26 


.42 


0.84 


SE 


1 


.84 


0.84 


.86 


0.86 


DE 


1 


.77 


0.77 


.88 


0.88 


LO 


1 


.59 


0.59 


.67 


0.67 


SI 


1 


.77 


0.77 


.78 


0.78 


DI 


4 


.73 


2.92 


.45 


1.80 


LP 


1 


.33 


0.33 


.59 


0.59 


SL 


1 


.25 


0.25 


.45 


0,45 


DL 


1 


.33 


0.33‘ 


.53 


0.53 


LT 


1 


.51 


0.51 


.42 


0.42 


SN 


2 


.38 


0.76 


.71 


1.42 


DT 


1 


.62 


0.62 


.45 


0.45 


MA 


1 


.78 


0.78 


.61 


0.61 


SS 


1 


.67 


0.67 


.67 


0.67 


EE 


i 


.81 


0.81 


.81 


0.81 


MD 


1 


.13 


0.13 


.42 


0.42 


TA 


3 


.74 


2.22 


.83 


2.49 


El 


1 


.73 


0.73 • 


.59 


0.59 


MO 


2 


.55 


1.10 


.72 


1.44 


TI 


1 


.82 


0.82 


.73 


0.73 


EK 


1 


.00 


0.00 


.45 


0.45 


M 


4 


.51 


2. 04 


.51 


2.04 


TQ 


1 


.13 


0.13 


,00 


0.00 


ER 


1 


.99 


0. 99 


.87 


0.87 


NO 


7 


.66 


4.62 


.92 


5.74 


UB 


1 


.33 


0.33 


.25 


0.25 


EQ 


1 


.58 


0.58 


.00 


0.00 


NX 


1 


.00 


0. 00 


.13 


0.13 


UC 


1 


.33 


0.33 


.38 


0.38 


ER 


1 


.94 


0.94 


.96 


0.96 


HZ 


1 


.00 


0.00 


.00 


0.00 


UO 


2 


.13 


0.26 


.79 


1.58 


FI 


1 


.80 


0. 80 


.55 


0. 55 


OC 


1 


.51 


0.51 


.80 


0.80 


VY 


1 


.00 


0. 00 


.00 


0. 00 


GB 


1 


.00 


0. 00 


.00 


0.00 


OE 


1 


.33 


0.33 


.58 


0. 58 


XX 


1 


.00 


0.00 


.00 


0.00 


GL 


2 


.25 


0.50 


.13 


0.26 


OG 


1 


.25 


0.25 


.45 


0.45 


YF 


1 


.56 


0. 56 


.13 


0.13 


GP 


1 


.25 


0.25 


.00 


0.00 


01 


3 


.42 


1.26 


.80 


2.40 




125 




58.34 




63.02 


GR 


3 


.42 


1.26 


.48 


1.44 


OL 


1 


.67 


0.67 


.59 


0.59 
















(1) Identity of cipher digraph appearing in the cryptogram. | 

(2) Frequency of the particular digraph as It occurs in the cryptogram.| 

(3) Logarithm of theoretical plaintext frequency of the particular digraph (from Table 15, Appendix 2 % 

(4) Product of entries in columns (2) and (3). I 

(5) Logarithm of theoretical plaintext frequency of the digraph's reversal (from Table 15, Appendix 2). 

(6) Product of entries in columns (2) and (5), 
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than the "direct transparency" value, It may he assumed^^ to Involve a 
horizontal two-square— if , indeed, two-square encipherment has been em- 
ployed. It is now for us to establish whether or not this latter ^ the 
case, and this will Tje done by determining whether or not the foregoing 
observed value, 63*02, is' representative of the degree of transparency 
which may be ejqpected in a horizontcd two^-square cipher, (if the "direct 
transparency” value had been the higher of the two, then it would have 
been more probable that a vei^tical two -square were involved, and it would 
be necessary to determine whether or liot this observed value was repre- 
sentative of the degree of transparency expected in a • vertical two -squall 
cipher) . 

e. The observed "inverse transparency" value (selected in this case 
because it is the higher observed value) will be compared with the value 
expected from a horizontal two-square -cryptogram of the same size, and if 
this observed valiie la as great as or greater than the transparency value 
e^qpected for horizontal two-sqviarea, the cryptogram may be considered to 
be a horizontal two-square cipher; if the observed -value is lower ^sn 
the expected two-square value, decision Will have to be suspended.^ The 
transparency value expected in a horizontal two-sqviare cipher containing 
N digraphs is computed by maltiplylng K by .3388, which- in this case 



Actually, if the tyo-square hypothesis is made, the difference, be- 
tween the horizontal two-sqmre value and the vertical two-square value 
will indicate the degree of probability of the higher score over the 
lower. In this, case, the difference of h.68 (= 63*02 - 58*3^) > which 
represents a difference of log scores, is equivalent to an overwhelming 

ratio of 100 billion to 1 (i*e., 224 ° to l) in favor of the hypothesis 

of a horizontal two-sqviare. The foregoing computation involves an aspect 
of mathematics which will be given detailed treatment in Military Crypt- 
analysis, Part III. 

20 

For the benefit of the student with a background in statistics, it 
Is pointed out that by abiding by the stipulation "as great or greater”, 
some cryptograms which actually are the result of two-square ^cipherment 
may be rejected by this stipulation, but it will insvire that only a rela- 
tively few non- two-square cryptograms will be accepted. A better approach 
of a statistical natvcre wovild involve, first, computing the expected 
value for non -two-squares as well as that for two-squares. Then, any 
observed value falling below the ej^ected two-square value cotild be 
expressed in terms of the nimiber of standard deviations (i.e., the 
sigmage) from this expected two-square -value and/ from the expected non - 
two-square value. Finally, the particular expected value which would be 
considered as significant wovQ.d be the- one from which the" observed val\ie 
differed by the smaller number of standard deviations. The concept of 
standard deviation will be trea-ted in Military Cryptanalysis, Paarb III. 
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yields 42.35 (= *3389 x 125 ) .3® The observed value for the cryptogram, 
63 . 02 , is much higher than the elected value, 42.35. Thus, It has been 
proven statistically that the cryptogram at hand involves tvo-square 

encipherment, particularly, horizontal two-square encipherment. 

#• 

f . Having now proved that the Cryptogram at hand is a horizontal 
two-square cipher, the next step is to assume some: plain text in the 
message, guided by probable inverse transparencies ( inverse because the 
system has been identified as a horizontal two-square) in the cipher text. 
Referring to the work sheet in Fig. 62 , the repeated sequence at B9 and 
E9 i£ assumed to represent the plain text TA SK Fd RC (E-), on the basis 
of KBQ=SKp, and CR^rRC^. The plaintext-ciphertext; values are now 



30 

In the case of vertical two-squares, N would be multiplied by the 
constant . 361 O. The mathematical considerations tinderlylng this test and 
their p-mofs (involving Bayes* theorem and Bayes* (factors) are beyond the 
scope this text; however, for the benefit of thle mathematician, the 
derivation of the foregoing constants is explained! below, along with the 
derivation of the constant used for computing the jexpected transparency 
val\ie for non- two-squares . In the formulas, below, 

^ = the summation over all digraphs AA-ZZ 



z the frequency of a given digraph AB ^s found in Table 6 a, 
Appendix 2 

~ logarithm (to the base 224) of the frequency of a given 
digraph AB as found in Table 15 > Appendix 2 



For vertical two-squares. 



k 



zZ 

AB 



AB 



[• 



80(.0015) -S* 



For horizontal, two-squares. 



F 

.20 ^AB 



5000 



i _ 

•a 



3610 



AB BA 



r . 80 ( . 0015 ) ir . 33 !e 8 

*- 5000 J I 



For non -two square digraphic systems, 

k : I .2737 

676 
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recorded In a skeleton reconstxnictitn diagram as illustrated in Fig . 
64a. At A3, the assumption of (-R) EC ON HA IS SA BC (E-) is tossed off 
without much ado", since four of the six digraphs concerned are trans- 
parent. The plain-cipher relationships frpm this assumption are added 
to the reconstruction diagram, as shown in. Fig. 64h. Continuing in this 
vein, the plain text (-A) IN CR AF (T-) is Inserted at A10, and the plain 




■■■■■□□□■■□a 

■■■■■bIsSbbb 

BBBBQBBBBflflfl 




Figure 64a. 




Figure 64b,. 



text (-B) AT TL ES HI (P-) is Inserted at J3; the successive cumulative 
reconstruction diagrams for these two asstimptlons are shown In Figs. 64c 







O 






, 
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N 










A 


C 




1 






L 


N 


A 






8 


s 














S 




Ci 


K 


















F 










1 
















P 










O 


• 










E 


A 






8 


E 






C 































' Figure 64c. 



^During the reconstruction of the squares of the matrix, the student 
should keep clear In his skeleton diagram which letters are in the same 
row, and which are in the same column. It will he found expeditious to 
draw a dividing line (either horizontal or vertical, depending on the 
type of two-square matrix involved) on the page to keep the elements of 
the two squares independent, recording the values which are in the same 
row or column and writing down the letters as they are assumed. In the 
early stages of this process the student must exercise care in recording 
the letters so that no false relationships are formed; in other words, 
the values should he written down so that they are not In the same row or 
column with any letters other than those with ^ich they are known to he 
related. This will entail spreading the work rather widely over the page 
initially, then gradually telescoping and reducing the size of the re- 
construction diagram as the work progresses, until In the end it will he 
reduced to a concise matrix of two squares. 
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fl 
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fl 
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fl 
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fl 
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fl 
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Figure 64d. 



and 6Ud below.' It Is to be noted that at J7. 0C<. gPft p ; but elnce in 
Fls « 6^^d It has already been detesnnlned tha't 00^ =©Sp, then OCq most equal 
FS. aklng the word Bi^TTLESHII^ rather than In the singular. 

work sheet will look as 



g. At this point the partially filled- In 
follows : 



10 



15 



B 



uo 


DL 


CE 


NO 


AN 


SI 


GL 


BB 


El- 


I 

RI 


RC 


RG 


LN 


MO 


LC 




-R 


EC 


ON 


NA 


IS 


SA 


NC 


EA 


IR 


CR 


AF 


T- 


E- 




FT 


ER 


6R 


BB 


OE 


GP 


AB 


QW 


HN 




IP 


CR 


MO 


OR 


AP 




RE 


-E 


NC 


EO 


-E 


NE 




TA 


SK 


F0 


RC 


E- 


RO 


-E 


BE 


AM 


HA 


NX 


RA 


IE 


DA 


IR 


MA 


GB 


EK 


BS 


LC 


DD 


LC 










AR 


-0 




-0 




-E 












TQ 


OR 


EN 


OT 


MD 


TI 


AQ 


FI 


EQ 


TA 


NN 


BP 


NO 


UO 


OS 




RO 


BA 






IT 




-R 




AT 

1 


TA 




ON 






SN 


NN 


RK 


TA 


SE 


SN 


EL 


PO 


NN 


KS 


IP 


CR 


CE 


NO 


IS 


NS 


TA 




AT 


10 


NS 






TA 


SK 


FO 


RC 


EC 


ON 




HL 


IR 


KP 


IX) 


NO 


NZ 


DC 


TA 


LT 


1 

01 


IH 


OC 


NO 


CE 


RA 




-0 




OL 


ON 




-B 


AT 


TL 


E 


3 


HI 


PS 


ON 


EC 


aF^ 


OS 


DI 


NO 


EE 


KR 


LC 


DB 


RA 


OS 


D 


I 


IP 


DA 


RC 


0G‘ 


GR 






ON 


EE 








AR 








FO 




CR 




-E 


OL 


NO 


CW 


DI 


LP 


01 


LN 


QiX 


DI 


1 

GL 


RB 


BQ 


IF 


SS 


RA 


-S 


ON 








ES 


T- 






SA 

1 


N- 






L- 


AR 


VY 


01 


GR 


SL 


XX 


























ES 


-E 


LS 
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Skeletons of additional plain text, stich as the word OUR at Al, PRESENCE 
OF EMEMT at Bl, PRC©ABLE at Dl, ATTACK ON OUR INSTALLATIONS at DIO, 
CARRIER at Fl4, and VESSELS at Jl, may now clearly be seen. The complete 
recovery of the plain text follows, and the reconstruction diagram is 
con^jleted and telescoped into the form shown in Fig. Since phe- 

nomena- of keyword-mixed sequences are observed, the rows' and columns of 



Q 


M 


0 


K 


T 


N 


- 


Q 


L 


P 


A 


1 


C 


L 


N 


A 


B 


S 


R 


T 


G 


D 


F 


S 


H 


G 


K 


I 


F 


H 


U 


E 


P 


R 


B 


E 


C 


0 


D 


M 


Y 


- 


X 


V 


«• 


W 


Z 


Y 




X 



R E 


P 


u 


B 


D 


E 


M 


0 


C 


L I 


C 


A 


N 


R 


A 


T 


s 


B 


S D- 


F 


G 


H 


F 


G 


H 


i 


K 


KM 


0 


Q 


T 


L 


N 


P 


Q 


U 


V W 


X 


Y 


Z 


V 


W 


X 


Y 


Z 



Figure 64e. Figure 64f . 

Fig. ^Ue are permuted to yield the origlneJ. two-sqvi^e matrix as shown 
in Fig. 64f . 

h. The solution of vertical two 7 sq,uare systems follows analogous 
lines, with the necessary modifications of the reconstruction diagram in 
consonance with the difference in mechanics between horizontal and verti- 
cal two-square systems. 

i. A few additional remarks concerning the test applied in suhpars. 
d and e,* above, are in order. First, the exceptionally high transparency 
value Observed In this cryptogram is a direct resiilt of the very favor- 
able manner in which the keyword -mixed sequences in the two squares inter- 
act; in the foregoing cryptogram, ^7 of the 125 digraphs present (approx. 
38 ^) were inverse transparencies. -It is also pointed out that, although 
some actual two-square cryptograms may be rejected by that portion of the 
test which was described In subpar. e, the other phase of the test (de- 
scribed in subpar. d) — ^by which one may determine whether a cryptogram is 
more probably a vertical two-square encipherment or more probably a hori- 
zontal two-square encipherment — is extremely sensitive and' highly accu- 
rate . The foregoing statistical method is not merely valuable per se as 
an application- of cryptomatheraatlcs in the analysis of two-square matrix 
systems, but is Included as being illustrative of the general principles 
of special techniques that may be developed in the attack on any particu- 
lar cryptosystem, the mechanics of which are known to the cryptanalyst. 

The field of actual operational cryptanalysis is replete with special 
methods of attack of this nature. 

71. Analysis of Playfair cipher systems .— a. Of all digraphic 
cryptosystems eniilc^lng small matrices, the one”which has been most 
frequently encountered is the Playfair cipher. Certain variations of 
this cipher have been- incorporated in several complex manual ciphers 
used in actual operational practice; because of this it is important that , 
the stMent gain familiarity with the methods of solution of the classic 
Playfair system. 
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b.- The first published solutions^^ for this 
similar basically and vary only in minor details. 

Lieut. Mauborgne (later to become Chief Signal Ofificer of the U.S. Anny), 
used straightforward principles of frequency to establish the values of 
three or fovir of the most frequent digraphs. Then, on the ass\m 5 )tion 
that in most cases in which a Ijeyword appears on the first and second rows 
the last five letters of the normal alphabet, VWX|l!Z, will rarely be dls- 
ttirbed in sequence and will occupy the last row olf the square, he "jug- 
gles" the letters given by the values tentatively established from 
frequency considerations, placing them in variousi positions in the square, 
together with VWXYZ, to correspond to .the plaintext-ciphertext relation- ■ 
ships tentatively established. A later solution by Lieut. Frank Moorman, 
as described in Hitt's manual, assumes that in a Pls^air cipher prepared 
by nffians of a square In which the key word occupies the first and second 
rows, if a digraphic frequency distribution is maide, it will be found 
that the letters having the greatest combining pcwer are very probably 
lette’ if the key. A still later solution, by llleut. Commander Smith, 
is peinaps the most lucid and systematized of the[ three. He sets forth 
in definite language certain considerations which the other two writers 
certainly entertained but failed to indicate. j 

e. The following details have been summarized from Smith's so- 
lution: : 

(1) Hie Playfair cipher may be recognized bj| virtue of the fact that 

it always contains an even number of letters, and that when divided into 
groups of two letters each, no group contains a xfepetition of the same 
letter, as M or EE. Repetitions of digraphs, trigraphs, and polygraphs 
will be evident in fairly long messages. ' 

(2) Using the square^^ shown in Fig. 65 , there are two general cases 
to bq considered, as regards the results of enci;^herment; 



cipher are quite 
The earliest, that by 



rr 
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Figure 65 . 



32 



Mauborgne, Lieut. J. 0,, U.S.A. An advanced problem in cryptography 
and its solution , Leavenworth, 1914. i 

Hitt, Captain Parker, U.S.A, Manual for the solution of military 
ciphers , Leavenworth, I 918 . 

Smith, Lieut. Commander W, W., U.S.N. In Cryptography by Andre 

Langie, translated by J.C.H. Macbeth, New York, 1922. 

33 ! 

The Playfair square accon 5 >aroring Smith's solution is based upon the 

key word BAMRUPTCY, "to be distributed between the first and fourth lines 

of the square". This is a siii 5 >le depsurture from! the original Playfair 

scheme in which the letters of the key word are inritten from left to right 

and in consecutive lines from the top doimward. 
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Case 1 . Letters at opposite comers of a rectar^le. The following 
illustrative relationships are found: 



Beclproclty and reverfflbllity.^^ 






Case 2 » Two letters in the same row or column. The following il- 
lustrative relationships are found: 

Mp-Ec 

NAjnO}^ 

But NKp does not = ANq, nor does 
Reversibility only. 

( 3 ) The foregoing gives rise to the following: 

Rule I . (a) ' Regardless of the position of the letters in the 
~ sqmre , , if 



1.2l3*^» then 
2.114.3 



This rule is of particular aid in selecting probable words in the 
solution of Playfair ciphers, as will be shown shortly. 35 

(b) If 1 and 2 form opposite corners of a rectangle, the 
following eqiMitions obtain: 

1.2=3.^ 

2.1=4 . 3 
3-hzl.2 
4.3=2.! 



By way of e3q>laining what is meant by reciprocity and by reversi - 
bility, in t he case of digrapbic systems, the following examples are 
given; TI^iYFc and YPp^THc constitute a reciprocal relationship; 

TI^IWq and constitute a reversible relationship. 

35 

In this connection, a list of frequently-encountered words and 
phrases which contain reArersed digraphs (so-called "ABBA patterns") has 
been conqpiled and is inclxaied as Section E, "Digraphlc idiomorphs: 
Playfair", in Appendix 3* 



RE S TRICTED 



201 



REF ID:A66790 



nESTIHCTED 



(4) A letter considered as occt^ylng a position in a row can be com- 
bined with but four other letters in the saane row;j the same letter con- 
sidered as occupying a position in a column can be combined with but four 
other letters in the same column. Thus^ this letlier can be combined with 
only 8 other letters all told, under Case 2, above. But the same letter 
considered as occupying a corner of a rectangle can be combined with l6 
other letters, under Case 1, above. Smith derives from these facts the 
conclusion that "it would appear that Case 1 is twice as probable as 
Case 2” . He continues thus (notation my own) : i ' 



"Now in the sqviare, note that; 



Mp=Mc 

0I C = KK^ 

CIC=TK^ 

XTC=WK« 



also 



EHp=FA^ 

em: 

ETlzFP^ 

EWlrFV^ 

EFpZj'Gjj 



"From this it is seen that of the 24 equations that can be formed 
when each letter of the square is enployed either as the initial or final 
letter of the group, five will indicate a repetition of a corresponding 
letter of plain text. j 

"Hence, Rule II . After it has been determined, in the equation 

1.2s 3*4, that, say, ENpt^^,, there is a probability of one in five that 

any other grovp beginning with F_ indicates S©„, tod that any group 
ending in Aq Indicates ^ ; 

"After such combinations as have been assumed or 

determined, the above rule may be of use in disco’jrering additional di- 
graphs and partial words". | 



’W 



There is an error in this reasoning. Take, for example, the 24 equations having F as an initial letter: 



Case 




Case 


Case 


1 


Case 




1. 


FB.=DNp 


2. FE=ED 


2. 


FT=NM i 


1. 


FX=GW 


2. 


FD =EH 


1. FL=EM 


2. 


FW=NT 1 


1. 


FR=HN 


1. 


FI =DM 


1. FP=ET 


1. 


FK=GN 1 


2. 


FH=EG 


1. 


FU =DT 


1. FV=EW 


2. 


FG=EF [ 


1. 


FQ=HM 


1. 


FS =DW 


2. FN=NW 


1. 


F0=GM 1 


1. 


FY=HT 


1. 


FA =EN 


2. FIi=NP 


1. 


FC=GT 1 


1. 


FZ=HW 



Here, the initial letter F, represents the following initial letters of plain-text digraphs: 

DSp, E0p, NOp, G0p, and H0p. j 

It is seen that F, represents Dp, Np, Gp, Hp 4 times each, and Ep, 8 times. i Consequently, supposing that it has 
been determined that FAp=ENp, the probability that F, will represent Ep i^ not -1 in 5 but 8 in 24j or 1 in 3; but 
supposing that it has been determined that FW.=NTp, the probability that f „ will represent Np is 4 in 24 or 1 in 6. 
The difference in these probabilities is occasioned by the fact that the firi^t instance, FA.=ENp corresponds to a 
Case 1 encipherment, the second instance, FW.=NTp, to a Case 2 enciphernJent. But there is no, way of knowing 
initially, and without other data, whether one is dealing with a Case 1 or Case 2 encipherment. Only as an 
approximation, therefore, may one say that the probability of Fp representing a given 0p is 1 in 5. A probability 
of 1 in 5 is of almost trivial importance in this situation, since it representsisuch a "long shot” for success. The 
following rule might be preferable; If the equation 1.2=3. 4 has been established, where all the letters represented 
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Rule III . In the equatioh 1.2:3*^; 1 and 3 can never be Identical, 
nor can 2 and 4 ever be identical . Thus, ANp could not possibly be 
represented by AY^^, nor coiild be represented by KRq. This rule is 
usef u3. in elimination of certain possibilities vhen a specific message 
is being studied. / 

Rule IV . In the equation l.^r3*4c» if 2 and 3 are Identical, the 
letters are ali. in the same row or colirnm, and in the relative order 

1- 2-4 from left to right pr top to bottom^ respectively. In the square., 

shown, ANp =MKc and the absolute order is AUK. The relative order 1-2-4 
includes^flve absolute orders which are cyclic permutations, of one 
another. Thus: ANK. NK. «A, K..AN, ..ANK, and .ANK.» 

Rvtle V . In the equation 1.2p=3»4j., if 1 andL 4 are identical, the 
letters are all in the some row or column, and in the relative order 

2- 4-3 from left to right or top to bottom. In the square shown, KP^rRKc 

and the absolute order is KKR. The relative order 2-4-3 includes five 
absolute orders which are cyclic permutations of one another.. Thus 
NKR.., KR..N, R. .NK, . .NKR, and .NKR*. 

Rule VI . "Analyze the message for group recurrences. Select the 
groups of greatest recurrence and assume them to be high-frequency di- 
graphs. 37 Substitute the assumed digraphs througfhout the message, test- 
ing the ass\m?)tions in their relation to other groups of the cipher. The 
reconstruction of the sqviare proceeds simultaneously with the solution of 
the message and aids in hastenixig the translation of the cipher". 



by 1, 2, 3, and 4 are different, then there is a probability of 4/5 that a Case 1 encipherment is involved. Conse- 
quently, if at the same time another equation, 3.6=5.^. has been established, where 2 arid 3 represent the same 
letters as in the first equation, and 5 and 6 are different letters, also different from 2 and 3, there is a probability 
of 16/25 that the equation 1.6=5.4 is valid; or if at the same time that the equation 1. 2=3.4 has been determined, 
the equation 1. 6=5.4 has also been established, then there is a probability of 16/25 that the equation 3.6=5.2 is 

IS 84 SO 58 10 54 

valid. (Check this by noting the following equations based upon Fig. 25o; CE=PG, PH=YE, CH=YG. Note 
the positions occupied in Fig. 25a by the letters involved.) Likewise, if the equations 1. 2=3.4 and 1. 6=3.5 
have been simultaneously established, then there is a probability that the equation 2.5=4.6 is valid; or if the 
equations 1. 2=3.4 and 2.5=4.6 have been simultaneously established, then there is a probability that the 

12 24 12 22 22 42 

equation 2.5=4.6 is valid. (Check this by noting the following equations: CE=PG; CA=PK; EK=GA; note the 
positions occupied in Fig. 25a by the letters involved.) However, it must be added that these probabilities are 
based upon assumptions which fail to take into account any considerations whatever as to frequency of letters 
or specificity of composition of the matrix. For instance, suppose the 5 high-frequency letters E, T, R, I, N all 
happen to fall in the same row or column in the matrix; the number of Case 2 encipherments would be much 
greater than expectancy and the probability that the equation 1.2= 3.4 represents a Case 1 encipherment falls 
much below 4/5. 

37 ' 

A more acciirate guide to the deteijaination of the plaintext equiva- 
lents of high-frequency cipher digraphs would involve the consideration 
of the difference in frequency of a particular digraph and its reversal. 
Thus , an example, of a high-frequency 60p which is also high-frequency in 

its reverseG., is REpj an example of a high-frequency which is rarely 
found in its reversed form, is TI^. 
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d. (l) When eolutione for the Playfair cipher .system were first 
develi^edj based v®on the fact that the letters were inserted in the 
cells in Iseyword-mixed order, cryptographers thought It desirable to 
place stunibllng blocks in the path of such solution by departing from 
strict, keyword-mixed order. One of the simplest methods is illtistrated 
in Fig. 65, wherein it will be noted that the lastj five letters of the 
keyword proper axe inserted in the fourth row of the square Instead of 
the second, where they would naturally fall. Another method involves 
inserting the letters within the cells from left t(5 ri^t and top down- 
ward but using a sequence that is derived from a cblumnar transposition 
instead of a keyword -mixed sequence. Thus, using ^he keyword BAMRUPTCY: 

215^79683 10 : 

BANKRUPTCY ! 

DEFGHILMOQ 

S V W X Z 

Sfc^^uence: AEVBDSCOKGXNFWPLRiZTMUIYQ 

I 

The Playfair sqtxare is as follows: | 



A 


E 


V 


B 


D 


S 


C 


0 


K 


G 


X 


N 


F 


W 


P 


L 


R 


H 


z 


T 


M 


U 


I 


Y 


Q 



Figure 66a. 

(2) Note the following three squares: 




Z 


T 


L 


R 


H 


Y 


Q 


M 


U 


I 


B 


B 


A 


E 


V 

» 


K 


G 


S 


C 


0 


W 


P 


X 


N 


L 




0 


K 


G 


S 


C 


F 


W 


P 


X 


N 


H 


z 


T 


L 


R 


I 


Y 


Q 


M 


U 


V 


B 


D 


A 


E 




F W P X 
H Z T L 
I Y Q M 





Figure 66b. 



Figure 66c. 



Figure 66d. 



At first glance they all appear to be different, but closer examination 
shows them to be cyclic permutations of one another and of the square in 
Fig. 66a. They yield Identical cryptographic equiVeLLents in all cases. 
However, if an attempt be made to reconstruct the Original key word, it 
would be much easier to do so from Fig. 66a than from any of the others, 
because in Fig. 66a the original keyword -mTxed sequence has not been 
disturbed as much as in Figs. 66b, c, and d. In working with Playfair 
ciphers, the student should be on the lookout for ^uch instances of 
cyclic permutation of the original Playfair square;, for during the course 
of solution he will not know whether he is building ■up the original or an 
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equivalent cyclic permutation of the original matrix; Usually only after 
he has completely reconstructed the matrix will he he ahle to determine 
this point. 

e. (l) The steps in the solution of a typical example of this 



cipher' 

> 


will 


. now 


be 


illustrated. 




Let the 


message 


be 


: 'as 


follows : 










1 


3 


8 


4 


5 


e 


7 


8 


9 


10 


11 


13 


13 


14 


IS 


10 


17 IB 


19 


20 


31 


22 


23 




2S 


20 


27 


28 


29 


30 


A. 


V 


T 


Q 


E 


U 


H 


I 


0 


F 


T 


c 


H 


X 


A 


C 


A 


K.T 


X 


T 


R 


A 


Z 


E 


V 


T 


A 


G 


A 


E 


B. 


0 


X 


T 


y 


M 


H 


C 


R 


L 


Z 


z 


T 


Q 


T 


D- 


U 


M C 


Y 


C 


X 


C 


T 


G 


M 


T 


Y 


c 


Z 


U 


G. 


s 


N 


0 


p 


D 


G 


X. 


V 


3L 


S 


c 


A 


JK 


X 


V 


_T 


P K 


P 


U 


T 


Z 


•P 


T 


W 


z 


F 


N 


6 


G 


d: 


p 


T 


R 


K 


X 


I 


X 


B 


P 


R 


z 


0 


E 


P 


U 


T 


0 L 


Z 


E 


K 


T. 


T 


.C 


s 


N 


H 


C 


Q 


■M 


E. 


V 


T 


R 


K 


M 


W 


c 


F 


z 


U 


B 


H 


T 


V 


Y 


A 


B .6 


I 


P 


R 


Z 


K 


P 


c 


Q 


F 


N 


L 


V 


F* 


0 


X 


0 


T 


U 


Z 


E. 


Jl. 


c 


X 


X 


A 


A 


z 


X 


JH 


C Y 


N 


0 


T 


Y 


0 


L 


G 


X 


X 


I 


I 


H 


G- 


T 


M 


S 


M 


x_ 


c 




X 


_0. 


T 


c 


JL 


_0_ 




T 


C 


y A 


T 


E 


X 


H 


E. 


A 


C 


X 


« 

A 


C 


X 


X 


H.< 




Ji 


Y 


C 


T 


X 


w 


L 


z 


T 


s 


G 


p 


z 


T 


V 


Y W 


C 


E 


T 


W 


G 


C 


C 


M 


B 


H 


M 


9 


J. 


Y 


X 


Z 


P 


W 


G 


R 


T 


I 


V 


u 


X 


p 


u 


M 


Q 


R K 


M 


ff 


C 


X 


T 


M 


R 


S 


w 


G 


H 


B, 


K. 


X 


_c. 




X 


0 


T 


c_ 


z. 


_0 


.1 


M 


I 


p 


y 


D 


N 


F G 


K 


I 


T 


c 


0 


L 


X 


u 


E 


T 


P 


X 


L. 


X 


F 


S 


R 


S 


U 


z 


T 


D 


B 


H 


0 


z 


I 


G 


X 


R>K 


I 


X 


Z 


p. 


P 


V 


z 


I 


D- 


U 


H 


Q 


M. 


0 


T 


K 


T 


K 


c 


c 


H 


X 


X 









































(2) Without going through the preliminary tests in detail^ with 
which it will be assumed that the st\:^ent is now familiar, 3° the con- 
clusion is reached that the cryptogram is digraphic in nature, and a 
dlgraphic frequency distribution is made (Fig. 6 t)* 



See par. 6Sc. 
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1 ' 


'.'a-' 


a 4 a = a ■ f " 


a’ 


» . 


to' . a 


la 


■ 19 ■ 


a ts 


A. 


VT 


QC 


UiirlO FT CH XS* 


CA 


KT 


VT RA 


ZE 


VT 


AG- AE 


B. 


OX. 


,TY 


.MR, CR LZ ZT. QT 


DU 


MC 


. YC . .XC 


.TG 


MT 


YC- ZU 


C. 


SN 


OP 


DO XV XS CA KT 


VT 


PK 


PU TZ 


PT 


WZ 


FN BG 


D. 


PT 


,RK 


XI XB PR ZO . E? 


UT 


OL 


ZE liT 


TC ' 


SN 


HC QM 


E. 


VT 


RK 


m\'CF',ZU BH TV 


YA . 


BG- 


•IP RZ 


KP- 


CQ’ 


FN’-’LV 


F. 


OX 


• OT 


UZ -FA CX XC PZ 


•XH 


_CY 


• NO: . TY 


OL 


GX 


XI: IH 


G. 


. TM 


. SM 


XC PT OT CX OT 


TC., 


YA 


TE XH 


FA 


CX 


XC PZ 


H. 


,XH 


YC 


TX’ WL ZT ' SG PZ 


TV 


YW 


CE TW 


GC 


CM 


V- , 

bh''mq 


J. 


YX 


ZP 


WG -'RT ' IV’ ux pu" 


MQ' 


iuc 


• MW'' CX 


TM 


RS 


WG ■ 'HB' 


K. 


XC 


PT 


; aT ,CX OT MI. PY 


DN 


.FG 


‘ki'.tq 


OL 


XU 


-ET- . PX- 


L. 


xf' 


SR 


su' ZT DB- HO ZI’ 


GX 


RK' 


IX' ZP 


PV 


ZI.’ 


i?U HQ' 




bTv 


. KT. 


,KC CH XX- 

* * ' i ' 


; 




• - 


'* i 


1 . 




(3) 


. * 1 < 
The fdllowing- three- f siirly- -leng-fehy repetitions 


are 

I 't 


nbted: 


, , 




' ' • i • 


Lines ■ '• ' 

. F. ot- ..oz';.fa:. gx 


• » 

•XC 


A ** 

•PZ.' 


XH- 'CY- 


NO 








- 




d: TE 'xH - FA ^ ' 


’XC 


PZ' 


_M' YC 


TX 




% .’i 




’ * ' . 




a' '-’ch' XS CA 


KT 


vf 


■Ra‘ ,.ZE 


s 


: ' 


V, f ' 








' C.-.' DG XV- XS CA 


KT 


■ VT 


PK'-* ‘PU 


** 


.1 










’ G. TM SM' XC ' ‘PT 


OT 


CX 


OT TC 




s ' ‘ 






' 


• 


K. WG HB XC PT 


OT 


cx’ 


OT. MI 






^ ' 'V 






The first long .repetition^ vith .the sequent reversed dJ^aphs.,CX ^d XC 
iJimediately ' suggests the word BAITALION (see -Section ,E^ Appendix 3)j 
split up into’ -B’AT tX-LI^ON and the; sequence cdntaiping this , repet itdoij 
in lines F and- G becomes, as 'follows: ' / . 

» k ^ ^ .1 * 

Line F . . V" OX OT UZ FA CX -XC • •PZ XH ‘ CY NO TY 

' • ■ , B :AT TA LI ON 

Line G . .. . . YA TE XH FA ^CX XC PZ ’ XH YC' TX V?L. 

B ,AT TA ■ LI ON . ■ 

(4) Because of .the frequent use of numerals before the word BAT- . 
TALION (as mentioned In Section B of Appendix 4) and because of the ap- 
pearance of ONp before this word in line G, the’ possibility suggests 
itself that the word before BATTALION in line ,G is either OKS or SECOND. 
Tlie identical, cipher digraph FA in both cases gives a hint that the word 
BATTALION in line F may also be preceded by a nvnneral; if 01® is correct 
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in line G, then THREE is possible in line F. On the other 'hand, if 
SECOl© is correct in-line G, then THE® is possible in line .F. Thus; 



Line F 


OX 


OT 


UZ 


FA 


CX 


XC 


PZ 


XH 


■CY 


NO 


TY 


1st hypothesis .... 


-- 


TH 


RE 


EB 


AT 


TA 


LI 


ON 








2nd hypothesis .... 




TH 


IR 


m 


AT 


TA 


LI 

1 


ON' 








Line G 


YA 


TE 


XH 


FA 


CX 


XC 


1 

PZ 


XH 


YC 


TX 


NL 


1st hypothesis.... 


— 


— 


ON 


EB 


AT 


TA 


1 

1 

LI 


ON 








2nd hypothesis . . . . 


-S 


EC 


. ON 


TB 


AT 


TA 


1 

LI 


ON 









First, '-.e that if either hypothesis is true, then OTgSTHp. ■ The 
frequei— / distribution shows that OT occvirs 6 times and is in fact the 
most frequent digraph in the message. Moreover , py Rule I of subpara- 
graph b, if OTc=THp then TOgsHTp. Since HTp is a; very rare- digraph in 

normal plain text, TO^ shoiild either not .occur at|-all in so short a 
message or else it should be very Infrequent. The frequency distribution 
shows that it does not occur. Hence, there is nothing inconsistent with 
the s\jpposition that the word in front of BATTALION in line F is THREE or 
TKEE®, and there is some evidence that it is actually one or the other. 

( 5 ) But can evidence be found for the support of one hypothesis 
against the other? Let the frequency distribution be examined with a 
view throwing light upon this point . If the first hypothesis is true, 
then UZg3?Ep, and, by Rule I, ZUc=ERp* The frequency distribution shows 

but one occxirrence of UZ^, and bijt two occuil-ences ' of ZU^,. These do not 

look very good for ^ and ER.- On. the other hand,' I if the second hypothesis 
is true, then UZ^sIRp and, by Rule I, ZU^rRIp. Tie frequencies are much 

more favorable in this case. Is there anything .jndonsistent_wlth the 
assunption, on the basis of the second hypothesis., that' fEf.sECp? The 
frequency distribution shows no inconsistency, for TB ,. oc curs once and 
ETp(=CEp, by Rule l) occurs once. As' regards whether FAc:=E3p or =IBp, 

both hypotheses are tenable.; possibly the second hypothesis is s shade 

better than the first , on the following reasoning*: By Rule- if 7Ap£EiBp 

then AFp^BEp, or if FAc=IBp then AFp=BDp. The fact that no AEq occurs, 

whereas at least one may ^ expected in this message, inclines one to 
the second hypothesis, since BDp is very rare. 

(6) Let the 2nd hypothesis be assumed to be correct. . The additional 
values are tentatively inserted in the text, and in lines Q and K two 
interesting repetitions are noted: 

I . 

Line G TI4 SM XC FT OT OX OT - TC Yf TE )?H. FA CX XC PZ XH . 

TA id AT TH -S EC ON LB AT TA LI ON 

I 

Line 1C WG HB XC PT' OT CX OT MI pX DN F G XI TC 01. XU ET 

TA TH A'O Til ' 
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This certainly looks like STATE THAT. THE . * which would make TSp'PT^,. 
Furthermore, in line G the sequence STATETHATTHE. .SECOMBATTALIOH c£.n 
hardly be niching, else than STATE THAT THEIR SECOHD BATTALIOI'I, which 
woxjld make 'l'Cj,=EIp and YA^,=RSp. Also SM,,=-Sp. 

(7) It is perhaps high time .that, the whole, list of tentative equiva- 
lent values be studied in relation tp their consis.teacy. with the positions 
of letters In the Playfair sqii^e; mpreoyer, by so'^'daing’, 'Mditional ' 
values may be obtained in the process; The completd- list of values is 
as follows: 



Assumed values 



Derived by Rule I 





. ... 


I^zPZc 


' 


0Nt)=XHc 


N0d=HXc 


TRp=0Tc 


HTpzTOc - 








55p=^c - 


^=^c 


C^iETc 




ET^=^c 


EIpiTCe 


.Sp=CTc 


.RSprYAc 


■SRtjZAYc 


-SprSMc 


■ ” S-p=14Sc • 



(8) By Rule V, the equation -THp=OT^ means that H, 0, and T are all 
in the same row or column and in the abeolute order HTO;, similarly, C, E, 
and T are in the same row or column and in the absolute order GET. 
FurtherjE, P, and T are in the same row eind column, and their absolute 
order is ETP. That is, these sequences must occur someplace in the square 
in either rows or columns, taking into consideration of course the proba- 
bility of cyclic displacements of these sequences within the square: 



, (a) H T 0 (b) C E T (c) E T P • 

(9) Noting the common letters' E and’ T in the second ai^ -third se- 
quences, these two sequences may be combined into one sequence of foin* 
letters, viz ., C E T P. Since only' one position -remains to be filled in 
this row (or column) of the square ^ and noting iri the list of equivalents 
that EIpilTCc, it is obvious that the letter I belongs to the C E T P 
sequence j the con5>lete sequence is therefore C E T P I. 

(10) Since the sequence HTO has a common letter (T) with .the sequence 
CETPI, it follows that if the HTO sequence occupies a TOur, then the 
CETPI sequence must occupy a column; or, if the HTO sequence occupies a 
column, then the CETPI sequence must occupy a row; and they may be com- 
bined by means of their common let-ter, T, viz . ; 



! H 
iC E T P I 



or 



C ! 
■E I 
H T 0| 



P 

I 
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The proof of whethier the CETPI sequence, for exanqi>le , ' properly belongs as 
a row or a column of the Playfair square lies in ihe establishment of a 
rectangular relationship, instead of the linear relationships constructed 
thus far. > 

I 

(ll) We note that, from the assumptions in subpar. d(6), ATprCX^ and 

ONpZXHQ. The relationship ONp^XH^ might be elthei* a rectang\jlar one, such 
as 0^ >X, or it might be linear, viz . ,' HiOXN or;H. Since however 

It 

!o 

, lx 

• ■ In 

I 

ATprCXg must be a rectangular relationship, then only the configuration 



X 

H N 



; c A i 


1 h"" 


••• 


1 E j 


. !C E T P 


l! 


|H T 0 A N| will be valid. 


since the alternative form ! 0 




1 P 1 


!a X 




L-.I J 


i N 





will not 



satisfy the equation ATpsCX^. I 

( 12 ) The fragmentary. Playfair square^^ has befen established, ,in one 
of its 25 possible cyclic permutations, as j 




I 



Scanning the list of plain-cipher equivalents givjeri in subpar. d(7) in 
order to Insert possible additional letters, none| is found.. But seeing 
that several high-frequency letters have already been inserted in the 
matrix, perhaps reference to the .cryptogram itself in connection with 
values derived from these inserted letters may yiteld further clues. For 
exan 5 >le, the vowels A, E, I, and 0 are ej.1 in pos|ition, as are the very 
frequent consonants N and T. The following combinations may be studied: 



^:exc 






1 . T^=XCc 


ENpreTc . 


ETp=TPo 




1 


ISp=OTc 


ITp=C?c 


^rT0c 




ONpZXHc 


OTpzXOc 


I-!0p=HXc 


1 T0p=0Xc' ' 


actimG. practice, it. is more 


usual to 


) * 

i 

start with a much 



39 

diagram than a siir^ile 5*5 square; as relationships develop, the diagram 
is gradually condensed, uiitil finally a 5x5 squa^te er..^rgss. This pro- 
cedure is quite similar to that employed In the’ Reconstruction diagrams 
for two-square matrices. 
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Afp(=CXc), TAp(=XCc), ^(=XH,;), T^(=PTc) and E^(=I^) have already 

been inserted in the text. Of the others, only OXc(=TOp) occurs two 
times, and this value can ^ at once inserted in the text. But can the 
equivalents of AN, EN, or IN be found from frequency considerations? ___ 
Take ENp, for example; it is represented by er^,. What combination of ©T 
is most^likely to represent EN„ among the following cahdidates: 

wFq (4 times); by Rule I, would z TKc (no occurrences) 

(5 times); by Rule I, ®p would s TVg (2 times) 

ZTq (3 tj^s); by Rule I, NE^ would Z TOo (l time) 

VTq certainly looks good: it begins the message, suggesting the word 

ENEMSf, and the sequence PZTVq, in line H, would become the plaintext 
sequence LINE. Let this be 'assijmed to be correct , and let' the word 
ENBMI also be assimsed to be correct. Then EI^zQEc bhe partial squaz*e 
then becomes as shown herewith: 



P 

I 

C A 
V M E Q 
iN H T 0 X 



Figure 66b. 

( 13 ) In line E is seen the following sequence: 

Line E VT RK MW CF ZU BH TV YA BG IP RZ KP CQ FN LV 

EN RI NE RS PT -E 

' The plaintext sequence . . .RI. .NERS. «PT. . . suggests PRISONERS CAPTURED, 
as follows: 

MW CF ZU BH TV YA BG IP RZ KP 
P RI SO HE RS CA PT UR ED 

This gives the following new values: eppsOTj,; S0p:5i^; CA^sBGj,; UElpsRZj,; 

and EDpzKPg. The letters B and G can be placed in position in the 

partial square at once, since the positions of C and A are alrea^ known. 
The insertion of the letter B immediately permits the placement of the 
letter S, from the equation SOpsBHc* Of the remaining equations only 
EDprKPc can be used. Since E and P are fixed and are in the same colimm, 
D and K must .be in the same column, and moreover the K must be in the 
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same row as E. There; is' only one possible positio'n for K, viz .. Immedi- 
ately after Q. This avrtomatically fixes the position of D. The square 
is now as shown herewith: 



P D 
I 

G S C B A 
V M E Q K 
N H T 0 X 



Figure 68b. ' 



(l4) A review of all equations, including "the very first ones es- 
tablished, gives the following which may now be uBjed: EGBpaPAci BS^ZYA^. 

The first permits the Immediate placement of F; the second, by elimi- 
nation of possible positions, permits the placemerlt of both R and Y. 

The sq j is now as shown herewith; 



P F D 
Y I R 
G S C B A 
V M E Q K 
K H T 0 X 



Figure 68c. 

Once more a review is made of all remaining unused equations. LIpzPZ^ 
now i>ermits the placement of L and Z. IRpsUZ^, now permits the placement 

of U, which is confirmed by the equation URpsRZc fjrom the word CAPTUEfflD, 
There is then only one cell vacant, and it must be occupied by the only 
letter left unplaced, viz . , W. Thus the whole square has been recon- 
structed, and the message can now be deciphered. I 



L(W)P F D 
Z Y I U R 
G S C B A 
V M E Q K 
H H T 0 X 



Figure 68d. 



f . Reconstruction of the square in Playfair jciphers is normally 
carried on concurrently with the synthesis of the Iplain text, once a few 
correct assun^jtions have been made. Now, having just reconstructed the • 
square as shown in Fig. 68d, the question to be answered is whether this 
square is identical with the original enciphering imatrix or whether it 
is a cyclic permutation of the original square (which may have contained, 
say, a transposition -mixed sequence). Even though the cryptogram in 
subpar. 71e has been solved, this point is still of interest. 
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. (l) The square that is derived may not necessarily he the origin^ 
enciphering square; more than likely it will be one of the 2h possible 
cyclic permutations of the original square. If the Playfair square con- 
sisted of a keyt-r'^rd -mixed sequence; a permutation of the square will 
cause no difficulty in recovering the original matrix and hence the key 
word. For exaiisple, if the square derived in some other instance is 
Q T L N 0 then the square P Y R A M is easily recovered because of the 



X Z U V W 
A M P Y R 
B C I D S 
H K E F G 



I D S B C 
E F G H K 
L N 0 Q T 
U V W X Z 



tell-tale letters UVWXZ occvirring in a row of the derivative square. But 
when the Plaj'f air .square consists of a transposition-mixed sequence; then 
a different procedure must be adopted. 



.( 2 ) As an exait^le, let us talce the transposition matrix 
58614327 from which A F T D K is the original square . 



PYRAMIDS 
BCEFGHKL 
If O q T U V W X 
Z 



W I H V M 
G U P ,B N 
Z R E-Q S 
L X Y C 0 



Using the 



methods Illustrated in par. 51g; scanning Successive rows of the square 
will disclose sequences of letters which could have appeared as columns' 



in the transposition matrix. 



For exemple, discovery of the columns. I 

■ . H 

V 



D S 
K L 
W X 



will afford rapid recovery of the key word. But if Instead of the original 
square we had one of its permutations such as Q S Z R E, then treatment 

C 0 L X Y 
DRAFT 
V M W I H 
B N G U P 



of the “colvimna", e.g., F 


V 


0 


L 


Q, of the tentative transposition matrix 


T 


M 


L 


X 


S 


V 


W 


X 


Y 


Z 



(assuming' that some or all of the letters '7, W, X, Y, Z are in' the last • 
row of the transposition matrix) will be without significance; therefore 
the procedure above. is Inapplicable, without a slight modification. 

( 3 ) Since it will be noted that a permutation- of the rows will not 
affect the proced\n:e of keyword recovery, then we construct a 9x5 rec- 
tangle QSZREQSZR which contains the five squares which, result 
C 0 LX Y e 0 L X 
DKAFTDKAF 
VMWiHVMWI 
BNGUPBNGU 



singly from successi've permutations of the columns. A 5 x 5 cut-out square 
will be found convenient in testing each permutation in turn. Affirma- 
tive results will be obtained when the correct permutation is reached. 
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which in this case is the third square in the reitangie, namely, 

Z R E Q S. After rj&covery of the key word from •ihis permuted square it 
L X Y C 0 I 

A F T D K . 

W I H V M 
GUPBN, 

Is probable then that the original enciphering square must have been 

A F T D K. \ I 

W I H V M i 

G U P B K 

Z R E Q S / ' 

LXYCO I 

(4) In the case of the square recovered in Fig. 6 ^, it is found 
that, following the procedure outlined in subpars. (l), ( 2 ), and ( 3 ) 
above he key word is baaed on COMPAEY, recoverable from the following 
diagrtirfl: ■ 

I 

I 

2536147 I 

COMPANY i 

B D E F G H I i 

K L Q R S T U 
V W X Z ' 

' I 

The original square must have been this: j 



A 


G 


S 


C 


B 


K 


V 


M 


E 


Q 


X 


N 


H 


T 


0 


D 


L 


W 


P 


F 


R 


Z 


Y 


I 


U 



Figure 68e. 



Continued practice in the solutipn of Playfair ciphers will make 
the student quite expert in the matter euid will enable him to solve 
shorter and shorter, messages Also, with prac|tlce it will become a. 
matter of indifference to him as to whether the letters are inserted in 
the square with any sort of regulai'ity, such as Islmple keyword -mixed 
order transposition -mixed order, or in a purely random order. 

h. It may perhaps seem to the student that! the foregoing steps are 
somewhat too artificial, a bit too "cut and drie!d" in their accuracy to 
portray the process, of. analysis as it is applied in practice. For 
example, the critical, student may well object tO some of the assumptions 
and the reasoning in subpar. e(5), above, in which the words THREE and 



40 * ' I . . 

The author once had a student who "specialized" in Playfair ciphers 
and became so adept that he could solve messages containing as few as 
5 O- 6 O letters within '30 minutes. i 
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OKE (1st hypothesis) were I'e jecbed in favor of| the words THIRD and SECOHD 
(2nd liypothesis) . This rested largely upon the; rejection of R Ep and ERp 
as the equivalents of UZ^, and ZUc» and the adoption of IRp and Kip as 
their equivalents. Indeed, if the student wili examine the final message 
with a critical eye, he will find that while the bit of reasoning in step 

( 5 ) is perfectly logical, the assxmption iipon which it is based is in 

fact wj.'ong; for it liappens that in this case ERp occurs only once and REp 
does not occur at all. Consequently, although|most of the reasoning 
which led to the rejection of the first hypothesis and the adoption of 
the second was logical, it was in fact based upon erroneous assun^tion. 

In other words, despite the fact that the assunption was incorrect, a 
correct deduction was made. The student should taiee note that in crypt - 



analysis situations of this sort are not at all imusual . Indeed they are 



to be expected, and a few words of explanation 
ful. 



at this point may be use- 



±. Cryptanalysis is a science in which deduction, based upon ob- 
servational data, plays a very large role. But it is also trtie that in 
this science most of the deductions usxially rest upon asstunptlons. It 
is most often the case that the cryptanalyst is forced to make his as- 
sim^tions based t^pon a quite limited amount of text. It cannot be ex- 
pected that assuitptions based upon statistical | generalizations will 
always hold true when applied to data comparatively very much smaller in 
quantity than the total data used to derive the generalized rules. 
Consequently, as regards assun^tlons made in specific messages, most of. 
the time they will be correct, but occaBlonally they will be incorrect. 

In cryptanalysis it is often found that among the correct deductions 
there will be cases in which subsequently discovered facts do not bear 
out the assumptions on which the dedxictlon was jbased. Indeed, it is 
sometimes true that if the facts had been known before the deduction was 
made, this knowledge would have prevented makirlg the correct deduction. 
For example, suppose the cryptanalyst had someliow or other divined that 
the message under consideration contained no RE, only one ER, one.IR, and 
two RI's (as is actually the case). He would certainly not have been 
able to choose between the words THREE and OHE (1st hypothesis) aS 
against THIRD and SECOND (2d hypothesis) . JBut because he assumes that 
there should be more ERp's and REp's than IRp's and Rip's in the message, 

he deduces that UZ^. c^not he REp, rejects the first hypothesis and takes 
the second. It later tvirns out, after the problem has been solved, that 
the deduction was correct, although the assumption on_which it was based 
(expectation of more frequent appearance of REp| euid ERp) was, in fact, 
not true in this particular case. The cryptanalyst can only hope that 
the number of times when his deductions are correct, even thovigh based 
upon assumptions which later turn out to be errjDneous, will abundantly 
exceed the number of times when his deductions are wrong, even though 
based vpon assuitptions which later prove to be Correct. If he is lucky. 






See footnote IS on page 52. 
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the making of an assumption which is really not 
ference in the end and will not delay solution; 
favored with luck, it may act\xally help him solv^ 
case in this particular example. 



■^rue will make no dif- 
put if he is specially 
the message — as was the 



be made in connection 
what would have been the 



Another comment of a general nature may 
with this specific exan^le. The student may ask 
procedure in this case if the message had not contained ■ such a tell-tale 
repetition as the word BATTALION, which formed tlie point of departiire 
for the solution, or, as it is often said, permitted an "entering wedge" 
to be driven into the message. The answer to hi^ query is that if the 
word BATTALION had not been repeated, there woul^ probably have been some 
other repetition which would have permitted the same sort of attack. » If 
the student is looking for cut and dried, stralgntforward, unvarying 
methods of attack, he should remember that cryptanalysis, while con- 
sidered a branch of mathematics by some, is not science which has many 
"general solutions" such as are found and expected in mathematics proper. 
It is inherent in the very nature of cryptanalytd cs that, as a rule, 
only general principles can be established; their practical appli- 
cation must take advantage of peculiarities and particular situations 
which are noted in specific raeasages. This is especially true in a text 
on the subject. The Illustration of a general principle requires a 
specific example, emd the latter must of necessity manifest character- 
istics which make it different from any other example. The word BAT- 
TALION was not purposely repeated in this exang)le| in order to make the 
demonstration of solution easy; "it just happened! that way". In another 
exang)le, some other entering wedge would have been found. The student 
can be expected to learn only the general principles which will enable 
him to take advantage of the specific characteristics manifested in 
specific cases . Here it is desired to illustrate the general principles 
of solving Playfair ciphers and to i>oint out the fact that entering 
wedges must and can he found. The specific natur^-e of the entering wedge 
varies with specific examples. 

72. Analysis of polygraphic systems involvinlg large tables . — ^a. The 



analysis of systems incorporating large di^aphic tables is accon;pllshed 
by entering, within the appropriate cells of a 26x26 chart, data corres- 
ponding to the plain-cipher relationships of assuBSd cribs on 26x26 
charts, and examining the charts for evidences of symmetry or systematic 
construction in their compilation. The initial plaintext entries may, 
in the absence of cribs, be made on the basis of iigraphic frequency 
considerations, aided by idiomorphisras and repetitions. 

e incorporating tables 
tion of the monoalpha- 
will greatly accelerate 
this monoalphabet i- 
as the exaiaple in 
ekness, even if the re- 
ph as that in Fig. 49 
iwn in Fig. 5I may also 
has been correctly 



of 



b. In pseudo-digraphic systems, such as thos 
similar to Figs. 47 a and b, and 48 , the identlflca 
beticallyenciphered component of cipher digraphs 
plaintext entries, ^ince advantage may be taken 
city. Tables with a feature of reciprocity, such 
Fig. ^ 0 , may be exploited on the basis of this we 
ciprocal pairs are assigned at random. Tables suj 
and the one for trinome digraphic encipherment sho' 
be exploited with facility, once enough plain text 
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assumed and inserted to disclose their systematic construction. A word 
of warning is inserted here against making incautious ass\m5)tions con- 
cerning the exact Internal composition of tables such as that in Fig. 
since their unusxjial construction could easily mislead the analyst who 
Jumps to premature conclusions, la the case of a table such as Fig. 51 
wherein the trinomes have been inscribed in straight horizontals (or for 
that matter, any other known Inscription), if the dimensions of the table 
have been correctly assumed the simplest solv|tion involves a reduction to 
two alphabets, reflecting the sequences of letters for the side and top 
of the matrix; this solution closely parallels that of the numerical 
fovir-square system described in subpar. S$e. 

c. Because the foregoing principles are rather straightforward, it 

is not considered necessary to illustrate their application with examples. 
Of course, when digraphic tables of random construction have been used, 
no refinements in solution are possible. However, the recording of as 
few as 225 different plaintext digraphs and their ciphertext equivalents 
will theoretically enable the autonatic decryption of approximately 92^ 
of the cipher digraphs of messagesjand the recording of 335 plaintext- 
ciphertext values will enable the automatic decryption of 98^ of "the 
cipher digraphs; thus almost every message may be read in its entirety 
without recouurse to further assunqptlons . Actually, it should be pointed 
out that having only 122 matched plaintext -ciphertext equivalencies will 
theoretically enable the decryption of 75^ of the cipher digraphs, and 
enough skeletons of plain text may then be manifest to permit the decrypt- 
ion of the complete me,ssage texts. ^ 

d. It might be well to point out in connection with large di- 
graphTc tables that there exist literal types which give rise to mono- 
alphabetic distributions for both the initial letters and final letters 
of pairs. Such a table is illustrated in Fig. 69 below; 
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A 


B 


C 


D 


E 


F 


6 


R 


I 


J 


K 


L 


M 


H 


0 


P 


Q 


R 


s 


T 


U. 


V 


W 


X 


Y 


z 


A 


HQ 


YQ 
























JQ 


KQ 


MQ 


HQ 


lOQ 


PQ 


QQ 


SO 


TO 


VO 


VQ 


xo 


zo 


B 


HG 


YU 
























JU 


KU 


MU 


RU 


F 


PU 


QU 


su 


TU 


VU 


VU 


XU 


zu 


C 


HE 


YE 


























KE 


MB 


HE 


OE 


PE 


QB 


SE 


TE 


VE 


WE 


XE 


ZB 


D 


HS 


























JS 


KS 


MS 


MS 


ps 


PS 


OS 


ss 


T3 


VS 


VS 


xs 


zs 


B 


HT 


XT 
























JT 


KT 


MT 


HT 


OT 


FT 


QT 


ST 


TT 


VT 


VT 


XT 


ZT 


F 


HI 


YI 
























JI, 


KI 


MI 


MI 


01 


PI 


01 


SI 


TI 


VI 


VI 


XI 


ZI 


G 


HO 


























JO 


KD 


MO 


ESJ 


60 


PO 


00 


SO 


TO 


VO 


WO 


XO 


ZO 


H 








r<?i 




















JN 


XH 


MN 


HN 


6 m 


PM 


OM 


SM 


TM 


VM 


WN 


XM 


ZM 


I 


HA 


























JA 


KA 


MA 


MA 


6 a 


PA 


OA 


SA 


TA 


VA 


WA 


XA 


ZA 


J 


HB 


YB 
























JB 


KB 


MB 


ril 


6 b 


PB 


QB 


SB 


TB 


VB 


WB 


XB 


ZB 


K 


HL 


YL 














CL 










JL 


KL 


ML 


ML 


6 l 


PL 


QL 


SL 


TL 


VL 


WL 


XL 


ZL 


L 


HY 


YY 


DY 




















JY 


KY 


MY 


HY 


6 y 


PY 


OY 


SY 


TY 


VY 


VY 


XY 


ZY 


M 


re; 


TC 


DC 


RC 


AC 


















JC 


KC 


MC 


MC 


oc 


PC 


QC 


SC 


TC 


VC- 


VC 


XC 


ZC 


N 


HD 


YD 


•DD 


RD 


AD 
















GD 


JD 


KD 


MD 


m 


6 d 


FD 


QD 


SD 


TO 


VD 


WD 


XD 


h) 


0 


HF 


YF 


DF 


RF 


AF 
















GF 


JP 


KF 


MF 


MF 


OF 


PF 


OF 


SF 


TF 


VF 


WF 


XF 


ZF 


P 


HG 


YO 


DG 


RG 


AG 
















GO 


JG 


KG 


MG 


MG 


op 


PO 


OG 


SG 


TG 


VG 


VG 


XG 


ZO 


Q 


HH 


YH 


DH 


RH 


AH 


















JH 


KH 


MH 


MH 


OH 


PH 


OH 


SH 


TH 


VH 


WH 


XH 


ZH 


B 


HJ 


YJ 


i)J 


RJ 


AJ 


UJ 


LJ 














JJ 


KJ 


MJ 


MJ 


0|J 


PJ 


OJ 


SJ 


TJ 


VJ 


WJ 


XJ 


ZJ 


S 


HK 


YK 


DK 


RK 


AK 


UK 


LK 














JK 


KK 


MK 


NK 


OK 


PK 


QK 


SK 


TK 


VK 


WK 


XK 


ZK 


T 


EM 


YM 


DM 


RM 


AM 


UM 


LM 














JM 


KM 


MM 


[23 


OM 


PM 


OM 


SH 


TM 


VM 


VM 


XM 


ZM 


U 


HP 


YP 


DP 


RP 


AP 


UP 


LP 












GP 


JP 


KP 


MP 


NP 


OP 


PP 


OP 


SP 


TP 


VP 


VP 


XP 


ZP 


a 


HR 


YR 


DR 


RR 


AR 


UR 


LR 














JR 


KR 


MR 




OR 


PR 


QH 


SR 


TR 


VR 


VR 


XR 


ZR 


V 


HV 


YV 


DV 


RV 


A/ 


UV 


LV 














JV 


KV 


MV 


MV 


OV 


PV 


OV 


SV 


TV 


W 


WV 


XV 


ZV 


X 


HW 


YW 


DW 


m 


AW 




IM 














JW 


KW 


MW 


MW 


06 


PW 


QW 


SW 


TW 


VW 


W 


xw 


ZV 


y 


HX 


YX 


DX 


RX 


AX 


















JX 


KX 


MX 


tEl 


OX 


PX 


QX 


8 X 


TX 


VX 


WX 


XX 


ZX 


z 


HZ 


YZ 


DZ 






















JZ 


KZ 




MZ 


oz 


PZ 


QZ 


SZ 


TZ 


vz 


WZ 


xz 


ZZ 



Figure 69. 



yields the equivalent 



In effect, encipherment hy means of such a syBtem| 

of a two-alphahet cipher, with a transposition within each of the pairs 
of letters. The cipher text produced "by such a system may be character- 
ized by a large nvoriber of repetitions which begin j with the initial letter 
of digraphs and end on the final letter of digraphs and which are pre- 
ceded by digraphs having repeated initial letters lor which are followed 
by digraphs having repeated final letters; for exein^jle, ciphertext 
passages of the following type might often arise: 1 SF BD GB IK and 
' BD GB TfK (wherein the repeated plain text is actually represented by 
SiBBGK, affected by the transposition) . This systlem is included here as 
being illustrative of many simple systems which are capable of leading 
the student very much astre^^; in this instance, if one were unaware of 
the treuisposition feature involved and were tb attpmpt what appears to 
be the simple task of fitting plain text into the two monoalphabet ic 
portions on the basis of single-letter frequency cpnsideratjons, he could 
spend a great deal of time without success— probably without any idea of 
what was causing his difficulties. j 

e. A pseiado -trigraphic cipher involving a table such as that in 
Fig. 52 may be readily recognized as such, since t^o letters of each tri- 
graph enciphex'ed by means of such a table are trea 4 ed monoeO-phabetically. 
If three separate uniliteral frequency distributioris are made — one for 
each of the three letters of the cipher trigraphs --j two of the distri- 
butions should be monoalphabet ic. Then, exploiting the monoalphabet icity 
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(i.e.> the positional monoalphabeticity) thus disclosed in the cipher 
text, plain text can be fitted to the cipher on the basis of single- 
letter frequency considerations; in addition, advantage may be taken of 
partial idiomorphisras, if these idiomorphlsms involve the particular 
positions of the trlgraphs which have been treated monoalpbabetically. 

f . Fortunately, it is unlikely that trigraphic systems other than 
the foregoing pseudo -trlgraphic type will be .encountered, because they 
are difficult to manipulate without extensive tables or complicated rules 
for encrypt ion. The subject can be passed over with the sin5>le state- 
ment that their analysis requires much text to permit of solution by the 
frequency method,— and blood, sweat, and tears. ^2. 

73 ♦ Further remarks on polygraphlc substitution systems . — a. In the 
treatment of the. cryptography of the. vaurlous digraphic systems in this 
Section, the rules for encryption and decryption which have been illus- 
trated are the ’’standard" rules (l.e., the rules extant in cryptologic 
literature, or the rules most commonly encountered in operational prac- 
tice). Needless to say, however, there is no cryptologic counterpart of 
the Genieva Convention making these rules sacrosanct, nor forbidding the 
vise of other rules for enciphering deciphering. 

h. In two-square systems and Playfair systems there are possible 
(and,~ln fact, there have been encountered In operational practice) modi- 
fications of the usual enciphering and deciphering rules which, if not 
suspected, may pose difficulties in the identification of such systems 
and in their cryptanalysis. For exan^ile, In a vertical two -square system, 
when two plaintext letters fall In the same column, their cipher equiva- 
lents might be taken as the letters immediately to the right of or im- 
mediately below these plaintext letters. Similarly, in a horizontal two- 
square system, if two plaintext letters are in the same row, their cipher 
equivalents might be taken as those immediately below, or to the right of 
these letters. In Playfair cipher systems, two plaintext letters in the 
same row might be represented by the letters laimediately below; two 
plaintext letters In the same column might be represented by the letters 
immediately to the right; a plaintext doublet might be represented by a 
ciphertext doublet formed by doubling the letter immediately to the 
right, or below, or diagonally to the right and below, thus removing one 
of the identifying ciphertext characteristics of the normal Playfair 
system. In one case encountered. Instead of the nopial Playfair linear 
relationship ABp=BCc, the rule was changed to ABpsCBc (thus allowing a 



‘tJ. a 

However, see in this connection Appendix 8; "Lester S. Hill alge- 
braic encipherment", which gives a mathematical treatment of true poly- 
graphic encipherment for polygraphs of any size. (See also subpar. 73b) • 

h2 

If a trigraphic system is encountered in operational cryptanalysis, 
special solutions would he made possible by the application of cribs, the 
aid furnished by Isologs (not only in the same system, but also between 
systems), etc. 



RESTIUCTED 



219 



REF ID : A66790 



REOTRICTED 

letter to ’’represent Itself" — an "ln5)Ossiblllty" 
ment)j even this sinple modification caused diffjj 
because varleoit rules for encryption had not been 



in Playfair enclpher- 
cuLties in cryptanalysis 
considered. 



£. The placing of cribs in small -matrix dlgraphic systems may be 
guided by the cryptographic peculiarities of these systems, when the 
general system is known to, or suspected by the cryptanalyst; conversely, 
the placing of a known crib may assist in the determination of the type 
of cryptosystem, or in the rejection of other types of systems . . For 
exan 5 >le, cribs may be placed in Playfair ciphers | on the basis of the 
"non-crashing" feature of the normal Playfair; that is, on the basis 
that in the equation 1.2=3•^^ neither 1 and 3 nor 2 and U can be IdentlceJL. 
In horizontal two-square systexM, if = thusn^tp^ must equal (3«tp; 

and if p, then«»Pc mnst equal If, by placing a known crib 

In a cryptogram, evidence of non-reciprocity is disclosed (e.g., if 
ABp=CDci hut CDp=XIc)j "the cryptogram may be assijmed to be other than a 
vertical two-square cipher, since vertical two-sjiuare encipherment yields 
conq>lete reciprocity. In either type of two-squ^e system, if one of the 
two sqiiares is known (for exaBiple, a vertical twp-square might be employed 
in which the upper square is always a normal alphabet), the placement of 
cribs is materially facilitated. 

d. The 1 ^ test performed separately on the initial letter and final 
letter of ciphertext pairs from cryptograms prodjuced by small -matrix di- 
graphic systems will give resvilts neither close jto that eaqpected for 
plain text, nor close to that for random text. |The reason for the com- 
parative "roughness" or pronounced differences among the relative fre- 
quencies in these distributions, as contrasted with the "smoothness" 
expected of random, is that small -matrix digraphic systems are only 
partially dlgraphic in nature and that the encryption involves character- 
istics similar to those of monoalphabet Ic substitution with variants. 

This roughness of the uniliteral frequency, disti|ibut ions for the prefixes 
and suffixes, and, for that matter, for the ovei|-all cipher text, re- 
flects the partially digraphic natxnre of the encipherment. 

e. If the cipher letters V, W, X, Y, and Z are of very low fre- 
quency in the over-all imiliteral frequency distribution of a dlgraphic 
cryptogram or set of cryptograms, this may be tjiken as evidence that the 
cryptosystem is a small -matrix digraphic system employing keyword-mixed 
sequences in the matrix or matrices. Furthermore, in small-matrix 
systems involving keyword -mixed squares, if 6 ^ of 00 c is one of the 

letters WXYZ, the 6 ^ of the corresponding 60ip :.s likely to be one of 
these same letters. ^Similarly, if ©| is one of the letters VWXYZ, then 
6 ^ of the corresponding © 6 p is likely to, be one of these letters. 

f . In trinome -dlgraphic systems employing large tables, the tri- 
nomes may run from 001 to 676 , as in Fig. ^1, or any consecutive set of 
676 trinomes in the scale of 1000 possible trinpmes may be used. For 
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that matter, the entire spsn of trihomen 000-999 might ho vised in such a 
table, with occasional gaps, to hide the limitations of this system. As 
another means of disguising the limitation of 6j6 trinomes in such a 
system, three of the initial digits of the trinomes might have one vari- 
ant each — thus no limitation would exist in the first position of tri- 
nomes. The 001, or other starting point in the cyclic scale, need nob he 
at the upper left-hand corner of the table. The 676 trinomes in such 
tables may be inscribed in straight horizontals (i.e., in the normal 
manner of writing) as in Fig. 51^ or they might be inscribed according 
to some other route; they probably would not be inscribed in a random 
manner because clumsy "deciphering table s''’~wovild then be necessary. It 
is also possible that the trinomes .in a trinorae -digraphic system might be 
converted into tetranomes by the addition of a sum-check (to assist in 
error-correction) . 

The cryptanalysis of tetranome-trigraphic systems with matrices 
similar to that Illustrated in Fig. 59 involves a modification of the 
technique used in solving inverse four-square systems. If the plain- 
component and cipher-co)iponent sections of the large square have been 
inscribed according to the normal manner of writing (or any other manner, 
if known ) , the first two elements of the trigraphs may be reduced to a 
pair of cipher alphabets, and these two raonoalphabetic substitutions maj’’ 
be solved as indicated in subpar. 69^. The applicability of inverse 
four-square solution principles to this tetranome-trigraphic system of 
course rests on the fact that the ciphertext sections are kno^ra or as- 
sumed to contain the dinomes 00-99 in numerical order, inscribed in the 
normal manner of writing; the conversion of the first two elements of the 
trigraphs depends upon the knowledge of the mcijiner of inscription of the 
letters of the plain component sections, in order that the four occur - 
rences of the initial letters and tlie four occurrences of the finaJ. 
letters may be correctly combined into two monoalphabetic distributions. 
Of covirse, if the composition of the small square (for the third element 
of trigraphs) is known, the third letter of trigraphs may be automa- 
tically deciphered. If the composition of the small square is not known, 
a consideration of the frequencies of the converted dinomes for the ..mall 
square (i.e.,- the coordinates of the square to indicate the third member 
of trigraphs) may be used to obtain an entering wedge into this third 
monoalphabetic substitution. 

h. There are but a very limited number of known cipher mechanisms 
which employ the polygraphic encipherment principle in any form. U.S. 
Patent No. I51568O issued to A. Henkels in 1924 and U.S. Patent No. 
1845947 issued to Weisner end Hill in 1932 describe two such mechanisms 
which produce polygraphic substitution. The latter, that of Weisner and 
Hill, is of partictilar interest because it is based on a rather single 
mathematical process which can yield true polygraphic encipherment for 
polygraphs of any size. The underlying mathematical process, invented 
by Prof. Lester S. Hill of Hunter College suzd described in the "Araerican 
Mathematical Monthly" in I929 (Vol. XXXVI, p. 30^) 2nd 1931 (Vcl- 
XXXVIII, p. 135)^ is treated briefly, below; a more detailed treatment 
is conta.ined in Appendix 8, "Lester S. Hill algebraic encipherment", 
whjch also includes remarks on the cryptanalysis of this method of en- 
cipherment. 
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(l) Since Professor Hill's system is mathematjicaJ. in nature ^ the 
first step in its use involves the conversion of the plaihtext letters 
into numbers by means of a conversion alphabet which shows a corres- 
pondence between the 26 letters of the alphabet ai^d the 26 nxmibers from 
0 to 25 ^ such as the following: 



ABCDEFGHIJKLMNOPQ 
0 9 3 5 24 6 18 8 11 1 21 14 15 12 4 10 25 



RSTUVWXYZ 
17 7 19 20 2 22 16 23 13 



(2) The numbers obtained through the conversion Of the plaintesrt 
letters are next treated arithmetically through tlJe application of alge- 
braic linee^ functions, this treatment' being performed by means of mod 26 
arithmetic. 3 The nvimerical results yielded by the algebraic treatment 
are then converted back into letters by means of the conversion alphabet*, 
to yield the cipher equivalent of the original plajin text. 

(3) For example, suppose that the message "K0p?HING TO REPORT” is to 
be enciphered by trigraphs, and that, for this purpose, the enciphering 
keys^^ are 1, 2, 1; 5, H, 3; 2, h, I3. The messalge would be divided 
into trigraphs NOT-HIN-GTO-REP-ORT and the lettersl which result from the 
following operation would be taken as the cipher equivalent of the, first” 
trigraph; 

Using the conversion alphabet in (l), above, (NOT) is conver'bed 
into (12 4 19); then the foregoing keys are applied — 

l*t 12 + 2X4 -MX 19 = 12 + 8 + 19 = 13 ■9-1(26) = Z 

5x12+11x4+3x19 = 8 + 18+5 = 5 + lt26) s D 



2x12 + 4x4 + 13x19 = 24 + 16 + 13 = 1 



+ 2(26) a J 



Thus, NOTp is enciphered as ZDJ^. 

(4) A large mmiber of sets of enciphering and deciphering keys can 
be constructed. It is even possible to construct keys which yield re- 
ciprocal encipherment, and it is this possibility which makes practicable 



the construction of a machine or device to accoiipll 
deciphering. 



ish the enciphering and 



■TV 

^ Using "mod 26 arithmetic", one considers as the sum or product of 
two numbers, the number from 0-25 which is obtained by subtracting 26 
(or a mid,tlple of 26) from the ordinary arithmetical sum or product of 
the numbers . | 

44 

Encipherment of polygraphs containing n lettel 
n^ keys. Thus, 9 keys are necessary'- for trTgraphi 
graphic encipherment requires only 4 keys, whereas 
pentagraphic encipherment necessitate the use of I6 and 25 keys, respec 
tively. The nvimbers selected for use as keys muftt 
to rather definite rxiLes based on the "theory of determinants"; other- 
wise, cryptographic ambiguity may result when decipherment is attempted 
Appendix 8 contains more on this matter. - 



rs requires the use of 
|c encipherment; di- 
tetragraphic and 
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jL. Attention is called here to the applications of Table 13 ("Four- 
square individual frequencies") of Appendix 2 ; this table has been re- 
produced here for convenience. If the cryptanalyst has at hand a fairly 

(Table 13, Appendix 2) 

(Tlnniil on a eount at 6,000 dlKrapha) 
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large volume of cipher digraphs produced by encipherment with a normal 
four-st^re, he may use Table 13 as an aid in placing the initial letters 
and final letters of the cipher digraphs into the appropriate cells of the 
cipher conqaonent sections on the basis of their uniliteral frequencies. 



Thus, if a distribution made of the initial letters of cipher pairs in a 
particular example shows Iq, and Cg to be the letters of predominantly 
high frequency (listed in descending order of frequency), and if the 
distribution of the final letters shows Fg, Qc, and Pc as the letters of pre - 
dominantly high frequency •,( in descending order of ."r :quency), these 
letters may be tentatively placed into a skeleton four-square matrix as 
follows (Fig. 70), based on the locations of the highest frequencies as 
given in Table 13: 
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Figvire 70. 

In atten^tlng to diagnose the underlying cryptosystem In any 
partlcvilar polygraphic cipher, the student may gain some assistance from 
the following recapitulation: I 



(1) In dlgraphlc ciphers the majority of repjstitlons will he an 
even number of letters apart and these repetitions stould for the most 
part begin on the first letters of pairs and end on the last letters of 
psjlrs. The majority of repetitions in trigraphlc ciphers will be some 
multiple of three letters apart and these repetitions should for the most 
part begin on the first letters of trigraphs and end on the last letters 
of trigraphs. 

(2) Dlgraphlc ciphers may be revealed as such by the dlgraphlc phi 
test, with additional support being given by the aigraphic blank- 
expectation test; the presence of a nvill letter at the beginning of the 
cipher text might be disclosed by applying the twla foregoing tests to a 
distribution of the digraphs which are formed when the first letter of 
the text is omitted. 

(3) If either the tiniliteral frequency distribution for the initial 
letters or for the final letters of the digraphs in a cryptogram exhibits 
monoalphabet Icity, the cryptogram is probably a' pseudo-digraphic cipher 
involving a large title of the type in Fig. 47 or 46 . If both of the 
foregoing xiniliteral frequency distributions reflsct monoalphabet icity, 
the cryptogram may Involve the \ise of a table of jthe type in Fig. 69. 

( 4 ) If the "decipherment" of a cryptogram by means of a four-square 
matrix containing four normal alphabets yields twp* monoalphabetlc substi- 
tutions — one for the initial letters and, one for the final letters of the 




psexxLo-declpherment — the cryptogram may be assumep to be an Inverse four- 
square cipher. I 



(5) If an ocvilar inspection or statistical ejvaluation of the cipher 
text of a cryptogram reveals a large number of "transparencies", the 
cryptogram probably involves a two-square system. I 
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(6) If a cryptogram contains several cipher doiiblets, all of which 
are broken V 5 > when the cipher text is divided into digraphs, the crypto- 
gram may well Involve normal Playfair enciphennent . 

(7) If the cipher text of a cryptogram exhibits any invariable af- 
finity of one of the letters J, K, Q, or Z for vowels (or, for that 
matter i another cluster of 5 or 6 letters), the cryptogram probably is 
in a small -matrix system en^jloying sections consisting of more than 25 
letters . 

k. If a particular four-square cryptogram involves the use of a 
matrix in which either the plain con^wnent sections or the cipher com- 
ponent sections are normal alphabets, the matrix will be recovered 
through cryptanalysis in its original form, even when the components 
which are mixed have been derived by a transposition method or by no 
method at all. In Playfair cipher solution, the matrix can be recovered 
in its original form as long as the original matrix has been mixed in 
some systematic manner. However, in the case of two-square solution, 
there is no guarantee that the matrix can be recovered in its original 
form unless the original matrix has been keyvrord -mixed; if the original 
has been transposition-mixed, for exait 5 >le, the matrix which has been 
recovered throTjgh cryptanalysis — ^while being cryptographically equivalent 
to the original — ^wlll undoubtedly involve a permutation of the rows and 
columns of the original. 

l. When foxir-square systems are encountered in which the matrix 
consists of fow differently-mixed sections, reconstruction of the matrix 
is accomplished in a manner similar to that used in the analysis of two- 
square ciphers. If the sections sure coitposed of keyword-mixed sequences, 
the original matrix may be recovered. Otherwise, the reconstructed 
matrix will in all probability be a permutation of both the rows and the 
colxmme of the original matrix, and there may be no' way of recovering or 
or proving the original matrix. 

m. In passing, it might be well to mention that any two-square 
system can be solved as a fovtr-square system in which tlie aifftrSx. is 
con^>osed of foirr mixed sections; upon the realization, fr^w® pbeinQiaeiaa iro 
the matrix reconstruction, that a two-square matrix is invoXveda the 
proper conversion can then easily be made. 
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